xref: /linux/drivers/mtd/nand/raw/brcmnand/brcmnand.c (revision 3ad0876554cafa368f574d4d408468510543e9ff)
1 /*
2  * Copyright © 2010-2015 Broadcom Corporation
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  *
8  * This program is distributed in the hope that it will be useful,
9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11  * GNU General Public License for more details.
12  */
13 
14 #include <linux/clk.h>
15 #include <linux/version.h>
16 #include <linux/module.h>
17 #include <linux/init.h>
18 #include <linux/delay.h>
19 #include <linux/device.h>
20 #include <linux/platform_device.h>
21 #include <linux/err.h>
22 #include <linux/completion.h>
23 #include <linux/interrupt.h>
24 #include <linux/spinlock.h>
25 #include <linux/dma-mapping.h>
26 #include <linux/ioport.h>
27 #include <linux/bug.h>
28 #include <linux/kernel.h>
29 #include <linux/bitops.h>
30 #include <linux/mm.h>
31 #include <linux/mtd/mtd.h>
32 #include <linux/mtd/rawnand.h>
33 #include <linux/mtd/partitions.h>
34 #include <linux/of.h>
35 #include <linux/of_platform.h>
36 #include <linux/slab.h>
37 #include <linux/list.h>
38 #include <linux/log2.h>
39 
40 #include "brcmnand.h"
41 
42 /*
43  * This flag controls if WP stays on between erase/write commands to mitigate
44  * flash corruption due to power glitches. Values:
45  * 0: NAND_WP is not used or not available
46  * 1: NAND_WP is set by default, cleared for erase/write operations
47  * 2: NAND_WP is always cleared
48  */
49 static int wp_on = 1;
50 module_param(wp_on, int, 0444);
51 
52 /***********************************************************************
53  * Definitions
54  ***********************************************************************/
55 
56 #define DRV_NAME			"brcmnand"
57 
58 #define CMD_NULL			0x00
59 #define CMD_PAGE_READ			0x01
60 #define CMD_SPARE_AREA_READ		0x02
61 #define CMD_STATUS_READ			0x03
62 #define CMD_PROGRAM_PAGE		0x04
63 #define CMD_PROGRAM_SPARE_AREA		0x05
64 #define CMD_COPY_BACK			0x06
65 #define CMD_DEVICE_ID_READ		0x07
66 #define CMD_BLOCK_ERASE			0x08
67 #define CMD_FLASH_RESET			0x09
68 #define CMD_BLOCKS_LOCK			0x0a
69 #define CMD_BLOCKS_LOCK_DOWN		0x0b
70 #define CMD_BLOCKS_UNLOCK		0x0c
71 #define CMD_READ_BLOCKS_LOCK_STATUS	0x0d
72 #define CMD_PARAMETER_READ		0x0e
73 #define CMD_PARAMETER_CHANGE_COL	0x0f
74 #define CMD_LOW_LEVEL_OP		0x10
75 
76 struct brcm_nand_dma_desc {
77 	u32 next_desc;
78 	u32 next_desc_ext;
79 	u32 cmd_irq;
80 	u32 dram_addr;
81 	u32 dram_addr_ext;
82 	u32 tfr_len;
83 	u32 total_len;
84 	u32 flash_addr;
85 	u32 flash_addr_ext;
86 	u32 cs;
87 	u32 pad2[5];
88 	u32 status_valid;
89 } __packed;
90 
91 /* Bitfields for brcm_nand_dma_desc::status_valid */
92 #define FLASH_DMA_ECC_ERROR	(1 << 8)
93 #define FLASH_DMA_CORR_ERROR	(1 << 9)
94 
95 /* 512B flash cache in the NAND controller HW */
96 #define FC_SHIFT		9U
97 #define FC_BYTES		512U
98 #define FC_WORDS		(FC_BYTES >> 2)
99 
100 #define BRCMNAND_MIN_PAGESIZE	512
101 #define BRCMNAND_MIN_BLOCKSIZE	(8 * 1024)
102 #define BRCMNAND_MIN_DEVSIZE	(4ULL * 1024 * 1024)
103 
104 #define NAND_CTRL_RDY			(INTFC_CTLR_READY | INTFC_FLASH_READY)
105 #define NAND_POLL_STATUS_TIMEOUT_MS	100
106 
107 /* Controller feature flags */
108 enum {
109 	BRCMNAND_HAS_1K_SECTORS			= BIT(0),
110 	BRCMNAND_HAS_PREFETCH			= BIT(1),
111 	BRCMNAND_HAS_CACHE_MODE			= BIT(2),
112 	BRCMNAND_HAS_WP				= BIT(3),
113 };
114 
115 struct brcmnand_controller {
116 	struct device		*dev;
117 	struct nand_hw_control	controller;
118 	void __iomem		*nand_base;
119 	void __iomem		*nand_fc; /* flash cache */
120 	void __iomem		*flash_dma_base;
121 	unsigned int		irq;
122 	unsigned int		dma_irq;
123 	int			nand_version;
124 
125 	/* Some SoCs provide custom interrupt status register(s) */
126 	struct brcmnand_soc	*soc;
127 
128 	/* Some SoCs have a gateable clock for the controller */
129 	struct clk		*clk;
130 
131 	int			cmd_pending;
132 	bool			dma_pending;
133 	struct completion	done;
134 	struct completion	dma_done;
135 
136 	/* List of NAND hosts (one for each chip-select) */
137 	struct list_head host_list;
138 
139 	struct brcm_nand_dma_desc *dma_desc;
140 	dma_addr_t		dma_pa;
141 
142 	/* in-memory cache of the FLASH_CACHE, used only for some commands */
143 	u8			flash_cache[FC_BYTES];
144 
145 	/* Controller revision details */
146 	const u16		*reg_offsets;
147 	unsigned int		reg_spacing; /* between CS1, CS2, ... regs */
148 	const u8		*cs_offsets; /* within each chip-select */
149 	const u8		*cs0_offsets; /* within CS0, if different */
150 	unsigned int		max_block_size;
151 	const unsigned int	*block_sizes;
152 	unsigned int		max_page_size;
153 	const unsigned int	*page_sizes;
154 	unsigned int		max_oob;
155 	u32			features;
156 
157 	/* for low-power standby/resume only */
158 	u32			nand_cs_nand_select;
159 	u32			nand_cs_nand_xor;
160 	u32			corr_stat_threshold;
161 	u32			flash_dma_mode;
162 };
163 
164 struct brcmnand_cfg {
165 	u64			device_size;
166 	unsigned int		block_size;
167 	unsigned int		page_size;
168 	unsigned int		spare_area_size;
169 	unsigned int		device_width;
170 	unsigned int		col_adr_bytes;
171 	unsigned int		blk_adr_bytes;
172 	unsigned int		ful_adr_bytes;
173 	unsigned int		sector_size_1k;
174 	unsigned int		ecc_level;
175 	/* use for low-power standby/resume only */
176 	u32			acc_control;
177 	u32			config;
178 	u32			config_ext;
179 	u32			timing_1;
180 	u32			timing_2;
181 };
182 
183 struct brcmnand_host {
184 	struct list_head	node;
185 
186 	struct nand_chip	chip;
187 	struct platform_device	*pdev;
188 	int			cs;
189 
190 	unsigned int		last_cmd;
191 	unsigned int		last_byte;
192 	u64			last_addr;
193 	struct brcmnand_cfg	hwcfg;
194 	struct brcmnand_controller *ctrl;
195 };
196 
197 enum brcmnand_reg {
198 	BRCMNAND_CMD_START = 0,
199 	BRCMNAND_CMD_EXT_ADDRESS,
200 	BRCMNAND_CMD_ADDRESS,
201 	BRCMNAND_INTFC_STATUS,
202 	BRCMNAND_CS_SELECT,
203 	BRCMNAND_CS_XOR,
204 	BRCMNAND_LL_OP,
205 	BRCMNAND_CS0_BASE,
206 	BRCMNAND_CS1_BASE,		/* CS1 regs, if non-contiguous */
207 	BRCMNAND_CORR_THRESHOLD,
208 	BRCMNAND_CORR_THRESHOLD_EXT,
209 	BRCMNAND_UNCORR_COUNT,
210 	BRCMNAND_CORR_COUNT,
211 	BRCMNAND_CORR_EXT_ADDR,
212 	BRCMNAND_CORR_ADDR,
213 	BRCMNAND_UNCORR_EXT_ADDR,
214 	BRCMNAND_UNCORR_ADDR,
215 	BRCMNAND_SEMAPHORE,
216 	BRCMNAND_ID,
217 	BRCMNAND_ID_EXT,
218 	BRCMNAND_LL_RDATA,
219 	BRCMNAND_OOB_READ_BASE,
220 	BRCMNAND_OOB_READ_10_BASE,	/* offset 0x10, if non-contiguous */
221 	BRCMNAND_OOB_WRITE_BASE,
222 	BRCMNAND_OOB_WRITE_10_BASE,	/* offset 0x10, if non-contiguous */
223 	BRCMNAND_FC_BASE,
224 };
225 
226 /* BRCMNAND v4.0 */
227 static const u16 brcmnand_regs_v40[] = {
228 	[BRCMNAND_CMD_START]		=  0x04,
229 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
230 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
231 	[BRCMNAND_INTFC_STATUS]		=  0x6c,
232 	[BRCMNAND_CS_SELECT]		=  0x14,
233 	[BRCMNAND_CS_XOR]		=  0x18,
234 	[BRCMNAND_LL_OP]		= 0x178,
235 	[BRCMNAND_CS0_BASE]		=  0x40,
236 	[BRCMNAND_CS1_BASE]		=  0xd0,
237 	[BRCMNAND_CORR_THRESHOLD]	=  0x84,
238 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
239 	[BRCMNAND_UNCORR_COUNT]		=     0,
240 	[BRCMNAND_CORR_COUNT]		=     0,
241 	[BRCMNAND_CORR_EXT_ADDR]	=  0x70,
242 	[BRCMNAND_CORR_ADDR]		=  0x74,
243 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x78,
244 	[BRCMNAND_UNCORR_ADDR]		=  0x7c,
245 	[BRCMNAND_SEMAPHORE]		=  0x58,
246 	[BRCMNAND_ID]			=  0x60,
247 	[BRCMNAND_ID_EXT]		=  0x64,
248 	[BRCMNAND_LL_RDATA]		= 0x17c,
249 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
250 	[BRCMNAND_OOB_READ_10_BASE]	= 0x130,
251 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
252 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
253 	[BRCMNAND_FC_BASE]		= 0x200,
254 };
255 
256 /* BRCMNAND v5.0 */
257 static const u16 brcmnand_regs_v50[] = {
258 	[BRCMNAND_CMD_START]		=  0x04,
259 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
260 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
261 	[BRCMNAND_INTFC_STATUS]		=  0x6c,
262 	[BRCMNAND_CS_SELECT]		=  0x14,
263 	[BRCMNAND_CS_XOR]		=  0x18,
264 	[BRCMNAND_LL_OP]		= 0x178,
265 	[BRCMNAND_CS0_BASE]		=  0x40,
266 	[BRCMNAND_CS1_BASE]		=  0xd0,
267 	[BRCMNAND_CORR_THRESHOLD]	=  0x84,
268 	[BRCMNAND_CORR_THRESHOLD_EXT]	=     0,
269 	[BRCMNAND_UNCORR_COUNT]		=     0,
270 	[BRCMNAND_CORR_COUNT]		=     0,
271 	[BRCMNAND_CORR_EXT_ADDR]	=  0x70,
272 	[BRCMNAND_CORR_ADDR]		=  0x74,
273 	[BRCMNAND_UNCORR_EXT_ADDR]	=  0x78,
274 	[BRCMNAND_UNCORR_ADDR]		=  0x7c,
275 	[BRCMNAND_SEMAPHORE]		=  0x58,
276 	[BRCMNAND_ID]			=  0x60,
277 	[BRCMNAND_ID_EXT]		=  0x64,
278 	[BRCMNAND_LL_RDATA]		= 0x17c,
279 	[BRCMNAND_OOB_READ_BASE]	=  0x20,
280 	[BRCMNAND_OOB_READ_10_BASE]	= 0x130,
281 	[BRCMNAND_OOB_WRITE_BASE]	=  0x30,
282 	[BRCMNAND_OOB_WRITE_10_BASE]	= 0x140,
283 	[BRCMNAND_FC_BASE]		= 0x200,
284 };
285 
286 /* BRCMNAND v6.0 - v7.1 */
287 static const u16 brcmnand_regs_v60[] = {
288 	[BRCMNAND_CMD_START]		=  0x04,
289 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
290 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
291 	[BRCMNAND_INTFC_STATUS]		=  0x14,
292 	[BRCMNAND_CS_SELECT]		=  0x18,
293 	[BRCMNAND_CS_XOR]		=  0x1c,
294 	[BRCMNAND_LL_OP]		=  0x20,
295 	[BRCMNAND_CS0_BASE]		=  0x50,
296 	[BRCMNAND_CS1_BASE]		=     0,
297 	[BRCMNAND_CORR_THRESHOLD]	=  0xc0,
298 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xc4,
299 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
300 	[BRCMNAND_CORR_COUNT]		= 0x100,
301 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
302 	[BRCMNAND_CORR_ADDR]		= 0x110,
303 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
304 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
305 	[BRCMNAND_SEMAPHORE]		= 0x150,
306 	[BRCMNAND_ID]			= 0x194,
307 	[BRCMNAND_ID_EXT]		= 0x198,
308 	[BRCMNAND_LL_RDATA]		= 0x19c,
309 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
310 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
311 	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
312 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
313 	[BRCMNAND_FC_BASE]		= 0x400,
314 };
315 
316 /* BRCMNAND v7.1 */
317 static const u16 brcmnand_regs_v71[] = {
318 	[BRCMNAND_CMD_START]		=  0x04,
319 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
320 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
321 	[BRCMNAND_INTFC_STATUS]		=  0x14,
322 	[BRCMNAND_CS_SELECT]		=  0x18,
323 	[BRCMNAND_CS_XOR]		=  0x1c,
324 	[BRCMNAND_LL_OP]		=  0x20,
325 	[BRCMNAND_CS0_BASE]		=  0x50,
326 	[BRCMNAND_CS1_BASE]		=     0,
327 	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
328 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
329 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
330 	[BRCMNAND_CORR_COUNT]		= 0x100,
331 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
332 	[BRCMNAND_CORR_ADDR]		= 0x110,
333 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
334 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
335 	[BRCMNAND_SEMAPHORE]		= 0x150,
336 	[BRCMNAND_ID]			= 0x194,
337 	[BRCMNAND_ID_EXT]		= 0x198,
338 	[BRCMNAND_LL_RDATA]		= 0x19c,
339 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
340 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
341 	[BRCMNAND_OOB_WRITE_BASE]	= 0x280,
342 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
343 	[BRCMNAND_FC_BASE]		= 0x400,
344 };
345 
346 /* BRCMNAND v7.2 */
347 static const u16 brcmnand_regs_v72[] = {
348 	[BRCMNAND_CMD_START]		=  0x04,
349 	[BRCMNAND_CMD_EXT_ADDRESS]	=  0x08,
350 	[BRCMNAND_CMD_ADDRESS]		=  0x0c,
351 	[BRCMNAND_INTFC_STATUS]		=  0x14,
352 	[BRCMNAND_CS_SELECT]		=  0x18,
353 	[BRCMNAND_CS_XOR]		=  0x1c,
354 	[BRCMNAND_LL_OP]		=  0x20,
355 	[BRCMNAND_CS0_BASE]		=  0x50,
356 	[BRCMNAND_CS1_BASE]		=     0,
357 	[BRCMNAND_CORR_THRESHOLD]	=  0xdc,
358 	[BRCMNAND_CORR_THRESHOLD_EXT]	=  0xe0,
359 	[BRCMNAND_UNCORR_COUNT]		=  0xfc,
360 	[BRCMNAND_CORR_COUNT]		= 0x100,
361 	[BRCMNAND_CORR_EXT_ADDR]	= 0x10c,
362 	[BRCMNAND_CORR_ADDR]		= 0x110,
363 	[BRCMNAND_UNCORR_EXT_ADDR]	= 0x114,
364 	[BRCMNAND_UNCORR_ADDR]		= 0x118,
365 	[BRCMNAND_SEMAPHORE]		= 0x150,
366 	[BRCMNAND_ID]			= 0x194,
367 	[BRCMNAND_ID_EXT]		= 0x198,
368 	[BRCMNAND_LL_RDATA]		= 0x19c,
369 	[BRCMNAND_OOB_READ_BASE]	= 0x200,
370 	[BRCMNAND_OOB_READ_10_BASE]	=     0,
371 	[BRCMNAND_OOB_WRITE_BASE]	= 0x400,
372 	[BRCMNAND_OOB_WRITE_10_BASE]	=     0,
373 	[BRCMNAND_FC_BASE]		= 0x600,
374 };
375 
376 enum brcmnand_cs_reg {
377 	BRCMNAND_CS_CFG_EXT = 0,
378 	BRCMNAND_CS_CFG,
379 	BRCMNAND_CS_ACC_CONTROL,
380 	BRCMNAND_CS_TIMING1,
381 	BRCMNAND_CS_TIMING2,
382 };
383 
384 /* Per chip-select offsets for v7.1 */
385 static const u8 brcmnand_cs_offsets_v71[] = {
386 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
387 	[BRCMNAND_CS_CFG_EXT]		= 0x04,
388 	[BRCMNAND_CS_CFG]		= 0x08,
389 	[BRCMNAND_CS_TIMING1]		= 0x0c,
390 	[BRCMNAND_CS_TIMING2]		= 0x10,
391 };
392 
393 /* Per chip-select offsets for pre v7.1, except CS0 on <= v5.0 */
394 static const u8 brcmnand_cs_offsets[] = {
395 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
396 	[BRCMNAND_CS_CFG_EXT]		= 0x04,
397 	[BRCMNAND_CS_CFG]		= 0x04,
398 	[BRCMNAND_CS_TIMING1]		= 0x08,
399 	[BRCMNAND_CS_TIMING2]		= 0x0c,
400 };
401 
402 /* Per chip-select offset for <= v5.0 on CS0 only */
403 static const u8 brcmnand_cs_offsets_cs0[] = {
404 	[BRCMNAND_CS_ACC_CONTROL]	= 0x00,
405 	[BRCMNAND_CS_CFG_EXT]		= 0x08,
406 	[BRCMNAND_CS_CFG]		= 0x08,
407 	[BRCMNAND_CS_TIMING1]		= 0x10,
408 	[BRCMNAND_CS_TIMING2]		= 0x14,
409 };
410 
411 /*
412  * Bitfields for the CFG and CFG_EXT registers. Pre-v7.1 controllers only had
413  * one config register, but once the bitfields overflowed, newer controllers
414  * (v7.1 and newer) added a CFG_EXT register and shuffled a few fields around.
415  */
416 enum {
417 	CFG_BLK_ADR_BYTES_SHIFT		= 8,
418 	CFG_COL_ADR_BYTES_SHIFT		= 12,
419 	CFG_FUL_ADR_BYTES_SHIFT		= 16,
420 	CFG_BUS_WIDTH_SHIFT		= 23,
421 	CFG_BUS_WIDTH			= BIT(CFG_BUS_WIDTH_SHIFT),
422 	CFG_DEVICE_SIZE_SHIFT		= 24,
423 
424 	/* Only for pre-v7.1 (with no CFG_EXT register) */
425 	CFG_PAGE_SIZE_SHIFT		= 20,
426 	CFG_BLK_SIZE_SHIFT		= 28,
427 
428 	/* Only for v7.1+ (with CFG_EXT register) */
429 	CFG_EXT_PAGE_SIZE_SHIFT		= 0,
430 	CFG_EXT_BLK_SIZE_SHIFT		= 4,
431 };
432 
433 /* BRCMNAND_INTFC_STATUS */
434 enum {
435 	INTFC_FLASH_STATUS		= GENMASK(7, 0),
436 
437 	INTFC_ERASED			= BIT(27),
438 	INTFC_OOB_VALID			= BIT(28),
439 	INTFC_CACHE_VALID		= BIT(29),
440 	INTFC_FLASH_READY		= BIT(30),
441 	INTFC_CTLR_READY		= BIT(31),
442 };
443 
444 static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
445 {
446 	return brcmnand_readl(ctrl->nand_base + offs);
447 }
448 
449 static inline void nand_writereg(struct brcmnand_controller *ctrl, u32 offs,
450 				 u32 val)
451 {
452 	brcmnand_writel(val, ctrl->nand_base + offs);
453 }
454 
455 static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
456 {
457 	static const unsigned int block_sizes_v6[] = { 8, 16, 128, 256, 512, 1024, 2048, 0 };
458 	static const unsigned int block_sizes_v4[] = { 16, 128, 8, 512, 256, 1024, 2048, 0 };
459 	static const unsigned int page_sizes[] = { 512, 2048, 4096, 8192, 0 };
460 
461 	ctrl->nand_version = nand_readreg(ctrl, 0) & 0xffff;
462 
463 	/* Only support v4.0+? */
464 	if (ctrl->nand_version < 0x0400) {
465 		dev_err(ctrl->dev, "version %#x not supported\n",
466 			ctrl->nand_version);
467 		return -ENODEV;
468 	}
469 
470 	/* Register offsets */
471 	if (ctrl->nand_version >= 0x0702)
472 		ctrl->reg_offsets = brcmnand_regs_v72;
473 	else if (ctrl->nand_version >= 0x0701)
474 		ctrl->reg_offsets = brcmnand_regs_v71;
475 	else if (ctrl->nand_version >= 0x0600)
476 		ctrl->reg_offsets = brcmnand_regs_v60;
477 	else if (ctrl->nand_version >= 0x0500)
478 		ctrl->reg_offsets = brcmnand_regs_v50;
479 	else if (ctrl->nand_version >= 0x0400)
480 		ctrl->reg_offsets = brcmnand_regs_v40;
481 
482 	/* Chip-select stride */
483 	if (ctrl->nand_version >= 0x0701)
484 		ctrl->reg_spacing = 0x14;
485 	else
486 		ctrl->reg_spacing = 0x10;
487 
488 	/* Per chip-select registers */
489 	if (ctrl->nand_version >= 0x0701) {
490 		ctrl->cs_offsets = brcmnand_cs_offsets_v71;
491 	} else {
492 		ctrl->cs_offsets = brcmnand_cs_offsets;
493 
494 		/* v5.0 and earlier has a different CS0 offset layout */
495 		if (ctrl->nand_version <= 0x0500)
496 			ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
497 	}
498 
499 	/* Page / block sizes */
500 	if (ctrl->nand_version >= 0x0701) {
501 		/* >= v7.1 use nice power-of-2 values! */
502 		ctrl->max_page_size = 16 * 1024;
503 		ctrl->max_block_size = 2 * 1024 * 1024;
504 	} else {
505 		ctrl->page_sizes = page_sizes;
506 		if (ctrl->nand_version >= 0x0600)
507 			ctrl->block_sizes = block_sizes_v6;
508 		else
509 			ctrl->block_sizes = block_sizes_v4;
510 
511 		if (ctrl->nand_version < 0x0400) {
512 			ctrl->max_page_size = 4096;
513 			ctrl->max_block_size = 512 * 1024;
514 		}
515 	}
516 
517 	/* Maximum spare area sector size (per 512B) */
518 	if (ctrl->nand_version >= 0x0702)
519 		ctrl->max_oob = 128;
520 	else if (ctrl->nand_version >= 0x0600)
521 		ctrl->max_oob = 64;
522 	else if (ctrl->nand_version >= 0x0500)
523 		ctrl->max_oob = 32;
524 	else
525 		ctrl->max_oob = 16;
526 
527 	/* v6.0 and newer (except v6.1) have prefetch support */
528 	if (ctrl->nand_version >= 0x0600 && ctrl->nand_version != 0x0601)
529 		ctrl->features |= BRCMNAND_HAS_PREFETCH;
530 
531 	/*
532 	 * v6.x has cache mode, but it's implemented differently. Ignore it for
533 	 * now.
534 	 */
535 	if (ctrl->nand_version >= 0x0700)
536 		ctrl->features |= BRCMNAND_HAS_CACHE_MODE;
537 
538 	if (ctrl->nand_version >= 0x0500)
539 		ctrl->features |= BRCMNAND_HAS_1K_SECTORS;
540 
541 	if (ctrl->nand_version >= 0x0700)
542 		ctrl->features |= BRCMNAND_HAS_WP;
543 	else if (of_property_read_bool(ctrl->dev->of_node, "brcm,nand-has-wp"))
544 		ctrl->features |= BRCMNAND_HAS_WP;
545 
546 	return 0;
547 }
548 
549 static inline u32 brcmnand_read_reg(struct brcmnand_controller *ctrl,
550 		enum brcmnand_reg reg)
551 {
552 	u16 offs = ctrl->reg_offsets[reg];
553 
554 	if (offs)
555 		return nand_readreg(ctrl, offs);
556 	else
557 		return 0;
558 }
559 
560 static inline void brcmnand_write_reg(struct brcmnand_controller *ctrl,
561 				      enum brcmnand_reg reg, u32 val)
562 {
563 	u16 offs = ctrl->reg_offsets[reg];
564 
565 	if (offs)
566 		nand_writereg(ctrl, offs, val);
567 }
568 
569 static inline void brcmnand_rmw_reg(struct brcmnand_controller *ctrl,
570 				    enum brcmnand_reg reg, u32 mask, unsigned
571 				    int shift, u32 val)
572 {
573 	u32 tmp = brcmnand_read_reg(ctrl, reg);
574 
575 	tmp &= ~mask;
576 	tmp |= val << shift;
577 	brcmnand_write_reg(ctrl, reg, tmp);
578 }
579 
580 static inline u32 brcmnand_read_fc(struct brcmnand_controller *ctrl, int word)
581 {
582 	return __raw_readl(ctrl->nand_fc + word * 4);
583 }
584 
585 static inline void brcmnand_write_fc(struct brcmnand_controller *ctrl,
586 				     int word, u32 val)
587 {
588 	__raw_writel(val, ctrl->nand_fc + word * 4);
589 }
590 
591 static inline u16 brcmnand_cs_offset(struct brcmnand_controller *ctrl, int cs,
592 				     enum brcmnand_cs_reg reg)
593 {
594 	u16 offs_cs0 = ctrl->reg_offsets[BRCMNAND_CS0_BASE];
595 	u16 offs_cs1 = ctrl->reg_offsets[BRCMNAND_CS1_BASE];
596 	u8 cs_offs;
597 
598 	if (cs == 0 && ctrl->cs0_offsets)
599 		cs_offs = ctrl->cs0_offsets[reg];
600 	else
601 		cs_offs = ctrl->cs_offsets[reg];
602 
603 	if (cs && offs_cs1)
604 		return offs_cs1 + (cs - 1) * ctrl->reg_spacing + cs_offs;
605 
606 	return offs_cs0 + cs * ctrl->reg_spacing + cs_offs;
607 }
608 
609 static inline u32 brcmnand_count_corrected(struct brcmnand_controller *ctrl)
610 {
611 	if (ctrl->nand_version < 0x0600)
612 		return 1;
613 	return brcmnand_read_reg(ctrl, BRCMNAND_CORR_COUNT);
614 }
615 
616 static void brcmnand_wr_corr_thresh(struct brcmnand_host *host, u8 val)
617 {
618 	struct brcmnand_controller *ctrl = host->ctrl;
619 	unsigned int shift = 0, bits;
620 	enum brcmnand_reg reg = BRCMNAND_CORR_THRESHOLD;
621 	int cs = host->cs;
622 
623 	if (ctrl->nand_version >= 0x0702)
624 		bits = 7;
625 	else if (ctrl->nand_version >= 0x0600)
626 		bits = 6;
627 	else if (ctrl->nand_version >= 0x0500)
628 		bits = 5;
629 	else
630 		bits = 4;
631 
632 	if (ctrl->nand_version >= 0x0702) {
633 		if (cs >= 4)
634 			reg = BRCMNAND_CORR_THRESHOLD_EXT;
635 		shift = (cs % 4) * bits;
636 	} else if (ctrl->nand_version >= 0x0600) {
637 		if (cs >= 5)
638 			reg = BRCMNAND_CORR_THRESHOLD_EXT;
639 		shift = (cs % 5) * bits;
640 	}
641 	brcmnand_rmw_reg(ctrl, reg, (bits - 1) << shift, shift, val);
642 }
643 
644 static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)
645 {
646 	if (ctrl->nand_version < 0x0602)
647 		return 24;
648 	return 0;
649 }
650 
651 /***********************************************************************
652  * NAND ACC CONTROL bitfield
653  *
654  * Some bits have remained constant throughout hardware revision, while
655  * others have shifted around.
656  ***********************************************************************/
657 
658 /* Constant for all versions (where supported) */
659 enum {
660 	/* See BRCMNAND_HAS_CACHE_MODE */
661 	ACC_CONTROL_CACHE_MODE				= BIT(22),
662 
663 	/* See BRCMNAND_HAS_PREFETCH */
664 	ACC_CONTROL_PREFETCH				= BIT(23),
665 
666 	ACC_CONTROL_PAGE_HIT				= BIT(24),
667 	ACC_CONTROL_WR_PREEMPT				= BIT(25),
668 	ACC_CONTROL_PARTIAL_PAGE			= BIT(26),
669 	ACC_CONTROL_RD_ERASED				= BIT(27),
670 	ACC_CONTROL_FAST_PGM_RDIN			= BIT(28),
671 	ACC_CONTROL_WR_ECC				= BIT(30),
672 	ACC_CONTROL_RD_ECC				= BIT(31),
673 };
674 
675 static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
676 {
677 	if (ctrl->nand_version >= 0x0702)
678 		return GENMASK(7, 0);
679 	else if (ctrl->nand_version >= 0x0600)
680 		return GENMASK(6, 0);
681 	else
682 		return GENMASK(5, 0);
683 }
684 
685 #define NAND_ACC_CONTROL_ECC_SHIFT	16
686 #define NAND_ACC_CONTROL_ECC_EXT_SHIFT	13
687 
688 static inline u32 brcmnand_ecc_level_mask(struct brcmnand_controller *ctrl)
689 {
690 	u32 mask = (ctrl->nand_version >= 0x0600) ? 0x1f : 0x0f;
691 
692 	mask <<= NAND_ACC_CONTROL_ECC_SHIFT;
693 
694 	/* v7.2 includes additional ECC levels */
695 	if (ctrl->nand_version >= 0x0702)
696 		mask |= 0x7 << NAND_ACC_CONTROL_ECC_EXT_SHIFT;
697 
698 	return mask;
699 }
700 
701 static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
702 {
703 	struct brcmnand_controller *ctrl = host->ctrl;
704 	u16 offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_ACC_CONTROL);
705 	u32 acc_control = nand_readreg(ctrl, offs);
706 	u32 ecc_flags = ACC_CONTROL_WR_ECC | ACC_CONTROL_RD_ECC;
707 
708 	if (en) {
709 		acc_control |= ecc_flags; /* enable RD/WR ECC */
710 		acc_control |= host->hwcfg.ecc_level
711 			       << NAND_ACC_CONTROL_ECC_SHIFT;
712 	} else {
713 		acc_control &= ~ecc_flags; /* disable RD/WR ECC */
714 		acc_control &= ~brcmnand_ecc_level_mask(ctrl);
715 	}
716 
717 	nand_writereg(ctrl, offs, acc_control);
718 }
719 
720 static inline int brcmnand_sector_1k_shift(struct brcmnand_controller *ctrl)
721 {
722 	if (ctrl->nand_version >= 0x0702)
723 		return 9;
724 	else if (ctrl->nand_version >= 0x0600)
725 		return 7;
726 	else if (ctrl->nand_version >= 0x0500)
727 		return 6;
728 	else
729 		return -1;
730 }
731 
732 static int brcmnand_get_sector_size_1k(struct brcmnand_host *host)
733 {
734 	struct brcmnand_controller *ctrl = host->ctrl;
735 	int shift = brcmnand_sector_1k_shift(ctrl);
736 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
737 						  BRCMNAND_CS_ACC_CONTROL);
738 
739 	if (shift < 0)
740 		return 0;
741 
742 	return (nand_readreg(ctrl, acc_control_offs) >> shift) & 0x1;
743 }
744 
745 static void brcmnand_set_sector_size_1k(struct brcmnand_host *host, int val)
746 {
747 	struct brcmnand_controller *ctrl = host->ctrl;
748 	int shift = brcmnand_sector_1k_shift(ctrl);
749 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
750 						  BRCMNAND_CS_ACC_CONTROL);
751 	u32 tmp;
752 
753 	if (shift < 0)
754 		return;
755 
756 	tmp = nand_readreg(ctrl, acc_control_offs);
757 	tmp &= ~(1 << shift);
758 	tmp |= (!!val) << shift;
759 	nand_writereg(ctrl, acc_control_offs, tmp);
760 }
761 
762 /***********************************************************************
763  * CS_NAND_SELECT
764  ***********************************************************************/
765 
766 enum {
767 	CS_SELECT_NAND_WP			= BIT(29),
768 	CS_SELECT_AUTO_DEVICE_ID_CFG		= BIT(30),
769 };
770 
771 static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl,
772 				    u32 mask, u32 expected_val,
773 				    unsigned long timeout_ms)
774 {
775 	unsigned long limit;
776 	u32 val;
777 
778 	if (!timeout_ms)
779 		timeout_ms = NAND_POLL_STATUS_TIMEOUT_MS;
780 
781 	limit = jiffies + msecs_to_jiffies(timeout_ms);
782 	do {
783 		val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS);
784 		if ((val & mask) == expected_val)
785 			return 0;
786 
787 		cpu_relax();
788 	} while (time_after(limit, jiffies));
789 
790 	dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n",
791 		 expected_val, val & mask);
792 
793 	return -ETIMEDOUT;
794 }
795 
796 static inline void brcmnand_set_wp(struct brcmnand_controller *ctrl, bool en)
797 {
798 	u32 val = en ? CS_SELECT_NAND_WP : 0;
799 
800 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_SELECT, CS_SELECT_NAND_WP, 0, val);
801 }
802 
803 /***********************************************************************
804  * Flash DMA
805  ***********************************************************************/
806 
807 enum flash_dma_reg {
808 	FLASH_DMA_REVISION		= 0x00,
809 	FLASH_DMA_FIRST_DESC		= 0x04,
810 	FLASH_DMA_FIRST_DESC_EXT	= 0x08,
811 	FLASH_DMA_CTRL			= 0x0c,
812 	FLASH_DMA_MODE			= 0x10,
813 	FLASH_DMA_STATUS		= 0x14,
814 	FLASH_DMA_INTERRUPT_DESC	= 0x18,
815 	FLASH_DMA_INTERRUPT_DESC_EXT	= 0x1c,
816 	FLASH_DMA_ERROR_STATUS		= 0x20,
817 	FLASH_DMA_CURRENT_DESC		= 0x24,
818 	FLASH_DMA_CURRENT_DESC_EXT	= 0x28,
819 };
820 
821 static inline bool has_flash_dma(struct brcmnand_controller *ctrl)
822 {
823 	return ctrl->flash_dma_base;
824 }
825 
826 static inline bool flash_dma_buf_ok(const void *buf)
827 {
828 	return buf && !is_vmalloc_addr(buf) &&
829 		likely(IS_ALIGNED((uintptr_t)buf, 4));
830 }
831 
832 static inline void flash_dma_writel(struct brcmnand_controller *ctrl, u8 offs,
833 				    u32 val)
834 {
835 	brcmnand_writel(val, ctrl->flash_dma_base + offs);
836 }
837 
838 static inline u32 flash_dma_readl(struct brcmnand_controller *ctrl, u8 offs)
839 {
840 	return brcmnand_readl(ctrl->flash_dma_base + offs);
841 }
842 
843 /* Low-level operation types: command, address, write, or read */
844 enum brcmnand_llop_type {
845 	LL_OP_CMD,
846 	LL_OP_ADDR,
847 	LL_OP_WR,
848 	LL_OP_RD,
849 };
850 
851 /***********************************************************************
852  * Internal support functions
853  ***********************************************************************/
854 
855 static inline bool is_hamming_ecc(struct brcmnand_controller *ctrl,
856 				  struct brcmnand_cfg *cfg)
857 {
858 	if (ctrl->nand_version <= 0x0701)
859 		return cfg->sector_size_1k == 0 && cfg->spare_area_size == 16 &&
860 			cfg->ecc_level == 15;
861 	else
862 		return cfg->sector_size_1k == 0 && ((cfg->spare_area_size == 16 &&
863 			cfg->ecc_level == 15) ||
864 			(cfg->spare_area_size == 28 && cfg->ecc_level == 16));
865 }
866 
867 /*
868  * Set mtd->ooblayout to the appropriate mtd_ooblayout_ops given
869  * the layout/configuration.
870  * Returns -ERRCODE on failure.
871  */
872 static int brcmnand_hamming_ooblayout_ecc(struct mtd_info *mtd, int section,
873 					  struct mtd_oob_region *oobregion)
874 {
875 	struct nand_chip *chip = mtd_to_nand(mtd);
876 	struct brcmnand_host *host = nand_get_controller_data(chip);
877 	struct brcmnand_cfg *cfg = &host->hwcfg;
878 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
879 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
880 
881 	if (section >= sectors)
882 		return -ERANGE;
883 
884 	oobregion->offset = (section * sas) + 6;
885 	oobregion->length = 3;
886 
887 	return 0;
888 }
889 
890 static int brcmnand_hamming_ooblayout_free(struct mtd_info *mtd, int section,
891 					   struct mtd_oob_region *oobregion)
892 {
893 	struct nand_chip *chip = mtd_to_nand(mtd);
894 	struct brcmnand_host *host = nand_get_controller_data(chip);
895 	struct brcmnand_cfg *cfg = &host->hwcfg;
896 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
897 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
898 
899 	if (section >= sectors * 2)
900 		return -ERANGE;
901 
902 	oobregion->offset = (section / 2) * sas;
903 
904 	if (section & 1) {
905 		oobregion->offset += 9;
906 		oobregion->length = 7;
907 	} else {
908 		oobregion->length = 6;
909 
910 		/* First sector of each page may have BBI */
911 		if (!section) {
912 			/*
913 			 * Small-page NAND use byte 6 for BBI while large-page
914 			 * NAND use byte 0.
915 			 */
916 			if (cfg->page_size > 512)
917 				oobregion->offset++;
918 			oobregion->length--;
919 		}
920 	}
921 
922 	return 0;
923 }
924 
925 static const struct mtd_ooblayout_ops brcmnand_hamming_ooblayout_ops = {
926 	.ecc = brcmnand_hamming_ooblayout_ecc,
927 	.free = brcmnand_hamming_ooblayout_free,
928 };
929 
930 static int brcmnand_bch_ooblayout_ecc(struct mtd_info *mtd, int section,
931 				      struct mtd_oob_region *oobregion)
932 {
933 	struct nand_chip *chip = mtd_to_nand(mtd);
934 	struct brcmnand_host *host = nand_get_controller_data(chip);
935 	struct brcmnand_cfg *cfg = &host->hwcfg;
936 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
937 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
938 
939 	if (section >= sectors)
940 		return -ERANGE;
941 
942 	oobregion->offset = (section * (sas + 1)) - chip->ecc.bytes;
943 	oobregion->length = chip->ecc.bytes;
944 
945 	return 0;
946 }
947 
948 static int brcmnand_bch_ooblayout_free_lp(struct mtd_info *mtd, int section,
949 					  struct mtd_oob_region *oobregion)
950 {
951 	struct nand_chip *chip = mtd_to_nand(mtd);
952 	struct brcmnand_host *host = nand_get_controller_data(chip);
953 	struct brcmnand_cfg *cfg = &host->hwcfg;
954 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
955 	int sectors = cfg->page_size / (512 << cfg->sector_size_1k);
956 
957 	if (section >= sectors)
958 		return -ERANGE;
959 
960 	if (sas <= chip->ecc.bytes)
961 		return 0;
962 
963 	oobregion->offset = section * sas;
964 	oobregion->length = sas - chip->ecc.bytes;
965 
966 	if (!section) {
967 		oobregion->offset++;
968 		oobregion->length--;
969 	}
970 
971 	return 0;
972 }
973 
974 static int brcmnand_bch_ooblayout_free_sp(struct mtd_info *mtd, int section,
975 					  struct mtd_oob_region *oobregion)
976 {
977 	struct nand_chip *chip = mtd_to_nand(mtd);
978 	struct brcmnand_host *host = nand_get_controller_data(chip);
979 	struct brcmnand_cfg *cfg = &host->hwcfg;
980 	int sas = cfg->spare_area_size << cfg->sector_size_1k;
981 
982 	if (section > 1 || sas - chip->ecc.bytes < 6 ||
983 	    (section && sas - chip->ecc.bytes == 6))
984 		return -ERANGE;
985 
986 	if (!section) {
987 		oobregion->offset = 0;
988 		oobregion->length = 5;
989 	} else {
990 		oobregion->offset = 6;
991 		oobregion->length = sas - chip->ecc.bytes - 6;
992 	}
993 
994 	return 0;
995 }
996 
997 static const struct mtd_ooblayout_ops brcmnand_bch_lp_ooblayout_ops = {
998 	.ecc = brcmnand_bch_ooblayout_ecc,
999 	.free = brcmnand_bch_ooblayout_free_lp,
1000 };
1001 
1002 static const struct mtd_ooblayout_ops brcmnand_bch_sp_ooblayout_ops = {
1003 	.ecc = brcmnand_bch_ooblayout_ecc,
1004 	.free = brcmnand_bch_ooblayout_free_sp,
1005 };
1006 
1007 static int brcmstb_choose_ecc_layout(struct brcmnand_host *host)
1008 {
1009 	struct brcmnand_cfg *p = &host->hwcfg;
1010 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
1011 	struct nand_ecc_ctrl *ecc = &host->chip.ecc;
1012 	unsigned int ecc_level = p->ecc_level;
1013 	int sas = p->spare_area_size << p->sector_size_1k;
1014 	int sectors = p->page_size / (512 << p->sector_size_1k);
1015 
1016 	if (p->sector_size_1k)
1017 		ecc_level <<= 1;
1018 
1019 	if (is_hamming_ecc(host->ctrl, p)) {
1020 		ecc->bytes = 3 * sectors;
1021 		mtd_set_ooblayout(mtd, &brcmnand_hamming_ooblayout_ops);
1022 		return 0;
1023 	}
1024 
1025 	/*
1026 	 * CONTROLLER_VERSION:
1027 	 *   < v5.0: ECC_REQ = ceil(BCH_T * 13/8)
1028 	 *  >= v5.0: ECC_REQ = ceil(BCH_T * 14/8)
1029 	 * But we will just be conservative.
1030 	 */
1031 	ecc->bytes = DIV_ROUND_UP(ecc_level * 14, 8);
1032 	if (p->page_size == 512)
1033 		mtd_set_ooblayout(mtd, &brcmnand_bch_sp_ooblayout_ops);
1034 	else
1035 		mtd_set_ooblayout(mtd, &brcmnand_bch_lp_ooblayout_ops);
1036 
1037 	if (ecc->bytes >= sas) {
1038 		dev_err(&host->pdev->dev,
1039 			"error: ECC too large for OOB (ECC bytes %d, spare sector %d)\n",
1040 			ecc->bytes, sas);
1041 		return -EINVAL;
1042 	}
1043 
1044 	return 0;
1045 }
1046 
1047 static void brcmnand_wp(struct mtd_info *mtd, int wp)
1048 {
1049 	struct nand_chip *chip = mtd_to_nand(mtd);
1050 	struct brcmnand_host *host = nand_get_controller_data(chip);
1051 	struct brcmnand_controller *ctrl = host->ctrl;
1052 
1053 	if ((ctrl->features & BRCMNAND_HAS_WP) && wp_on == 1) {
1054 		static int old_wp = -1;
1055 		int ret;
1056 
1057 		if (old_wp != wp) {
1058 			dev_dbg(ctrl->dev, "WP %s\n", wp ? "on" : "off");
1059 			old_wp = wp;
1060 		}
1061 
1062 		/*
1063 		 * make sure ctrl/flash ready before and after
1064 		 * changing state of #WP pin
1065 		 */
1066 		ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY |
1067 					       NAND_STATUS_READY,
1068 					       NAND_CTRL_RDY |
1069 					       NAND_STATUS_READY, 0);
1070 		if (ret)
1071 			return;
1072 
1073 		brcmnand_set_wp(ctrl, wp);
1074 		nand_status_op(chip, NULL);
1075 		/* NAND_STATUS_WP 0x00 = protected, 0x80 = not protected */
1076 		ret = bcmnand_ctrl_poll_status(ctrl,
1077 					       NAND_CTRL_RDY |
1078 					       NAND_STATUS_READY |
1079 					       NAND_STATUS_WP,
1080 					       NAND_CTRL_RDY |
1081 					       NAND_STATUS_READY |
1082 					       (wp ? 0 : NAND_STATUS_WP), 0);
1083 
1084 		if (ret)
1085 			dev_err_ratelimited(&host->pdev->dev,
1086 					    "nand #WP expected %s\n",
1087 					    wp ? "on" : "off");
1088 	}
1089 }
1090 
1091 /* Helper functions for reading and writing OOB registers */
1092 static inline u8 oob_reg_read(struct brcmnand_controller *ctrl, u32 offs)
1093 {
1094 	u16 offset0, offset10, reg_offs;
1095 
1096 	offset0 = ctrl->reg_offsets[BRCMNAND_OOB_READ_BASE];
1097 	offset10 = ctrl->reg_offsets[BRCMNAND_OOB_READ_10_BASE];
1098 
1099 	if (offs >= ctrl->max_oob)
1100 		return 0x77;
1101 
1102 	if (offs >= 16 && offset10)
1103 		reg_offs = offset10 + ((offs - 0x10) & ~0x03);
1104 	else
1105 		reg_offs = offset0 + (offs & ~0x03);
1106 
1107 	return nand_readreg(ctrl, reg_offs) >> (24 - ((offs & 0x03) << 3));
1108 }
1109 
1110 static inline void oob_reg_write(struct brcmnand_controller *ctrl, u32 offs,
1111 				 u32 data)
1112 {
1113 	u16 offset0, offset10, reg_offs;
1114 
1115 	offset0 = ctrl->reg_offsets[BRCMNAND_OOB_WRITE_BASE];
1116 	offset10 = ctrl->reg_offsets[BRCMNAND_OOB_WRITE_10_BASE];
1117 
1118 	if (offs >= ctrl->max_oob)
1119 		return;
1120 
1121 	if (offs >= 16 && offset10)
1122 		reg_offs = offset10 + ((offs - 0x10) & ~0x03);
1123 	else
1124 		reg_offs = offset0 + (offs & ~0x03);
1125 
1126 	nand_writereg(ctrl, reg_offs, data);
1127 }
1128 
1129 /*
1130  * read_oob_from_regs - read data from OOB registers
1131  * @ctrl: NAND controller
1132  * @i: sub-page sector index
1133  * @oob: buffer to read to
1134  * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1135  * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1136  */
1137 static int read_oob_from_regs(struct brcmnand_controller *ctrl, int i, u8 *oob,
1138 			      int sas, int sector_1k)
1139 {
1140 	int tbytes = sas << sector_1k;
1141 	int j;
1142 
1143 	/* Adjust OOB values for 1K sector size */
1144 	if (sector_1k && (i & 0x01))
1145 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
1146 	tbytes = min_t(int, tbytes, ctrl->max_oob);
1147 
1148 	for (j = 0; j < tbytes; j++)
1149 		oob[j] = oob_reg_read(ctrl, j);
1150 	return tbytes;
1151 }
1152 
1153 /*
1154  * write_oob_to_regs - write data to OOB registers
1155  * @i: sub-page sector index
1156  * @oob: buffer to write from
1157  * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1158  * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1159  */
1160 static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
1161 			     const u8 *oob, int sas, int sector_1k)
1162 {
1163 	int tbytes = sas << sector_1k;
1164 	int j;
1165 
1166 	/* Adjust OOB values for 1K sector size */
1167 	if (sector_1k && (i & 0x01))
1168 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
1169 	tbytes = min_t(int, tbytes, ctrl->max_oob);
1170 
1171 	for (j = 0; j < tbytes; j += 4)
1172 		oob_reg_write(ctrl, j,
1173 				(oob[j + 0] << 24) |
1174 				(oob[j + 1] << 16) |
1175 				(oob[j + 2] <<  8) |
1176 				(oob[j + 3] <<  0));
1177 	return tbytes;
1178 }
1179 
1180 static irqreturn_t brcmnand_ctlrdy_irq(int irq, void *data)
1181 {
1182 	struct brcmnand_controller *ctrl = data;
1183 
1184 	/* Discard all NAND_CTLRDY interrupts during DMA */
1185 	if (ctrl->dma_pending)
1186 		return IRQ_HANDLED;
1187 
1188 	complete(&ctrl->done);
1189 	return IRQ_HANDLED;
1190 }
1191 
1192 /* Handle SoC-specific interrupt hardware */
1193 static irqreturn_t brcmnand_irq(int irq, void *data)
1194 {
1195 	struct brcmnand_controller *ctrl = data;
1196 
1197 	if (ctrl->soc->ctlrdy_ack(ctrl->soc))
1198 		return brcmnand_ctlrdy_irq(irq, data);
1199 
1200 	return IRQ_NONE;
1201 }
1202 
1203 static irqreturn_t brcmnand_dma_irq(int irq, void *data)
1204 {
1205 	struct brcmnand_controller *ctrl = data;
1206 
1207 	complete(&ctrl->dma_done);
1208 
1209 	return IRQ_HANDLED;
1210 }
1211 
1212 static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
1213 {
1214 	struct brcmnand_controller *ctrl = host->ctrl;
1215 	int ret;
1216 
1217 	dev_dbg(ctrl->dev, "send native cmd %d addr_lo 0x%x\n", cmd,
1218 		brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS));
1219 	BUG_ON(ctrl->cmd_pending != 0);
1220 	ctrl->cmd_pending = cmd;
1221 
1222 	ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);
1223 	WARN_ON(ret);
1224 
1225 	mb(); /* flush previous writes */
1226 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_START,
1227 			   cmd << brcmnand_cmd_shift(ctrl));
1228 }
1229 
1230 /***********************************************************************
1231  * NAND MTD API: read/program/erase
1232  ***********************************************************************/
1233 
1234 static void brcmnand_cmd_ctrl(struct mtd_info *mtd, int dat,
1235 	unsigned int ctrl)
1236 {
1237 	/* intentionally left blank */
1238 }
1239 
1240 static int brcmnand_waitfunc(struct mtd_info *mtd, struct nand_chip *this)
1241 {
1242 	struct nand_chip *chip = mtd_to_nand(mtd);
1243 	struct brcmnand_host *host = nand_get_controller_data(chip);
1244 	struct brcmnand_controller *ctrl = host->ctrl;
1245 	unsigned long timeo = msecs_to_jiffies(100);
1246 
1247 	dev_dbg(ctrl->dev, "wait on native cmd %d\n", ctrl->cmd_pending);
1248 	if (ctrl->cmd_pending &&
1249 			wait_for_completion_timeout(&ctrl->done, timeo) <= 0) {
1250 		u32 cmd = brcmnand_read_reg(ctrl, BRCMNAND_CMD_START)
1251 					>> brcmnand_cmd_shift(ctrl);
1252 
1253 		dev_err_ratelimited(ctrl->dev,
1254 			"timeout waiting for command %#02x\n", cmd);
1255 		dev_err_ratelimited(ctrl->dev, "intfc status %08x\n",
1256 			brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS));
1257 	}
1258 	ctrl->cmd_pending = 0;
1259 	return brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1260 				 INTFC_FLASH_STATUS;
1261 }
1262 
1263 enum {
1264 	LLOP_RE				= BIT(16),
1265 	LLOP_WE				= BIT(17),
1266 	LLOP_ALE			= BIT(18),
1267 	LLOP_CLE			= BIT(19),
1268 	LLOP_RETURN_IDLE		= BIT(31),
1269 
1270 	LLOP_DATA_MASK			= GENMASK(15, 0),
1271 };
1272 
1273 static int brcmnand_low_level_op(struct brcmnand_host *host,
1274 				 enum brcmnand_llop_type type, u32 data,
1275 				 bool last_op)
1276 {
1277 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
1278 	struct nand_chip *chip = &host->chip;
1279 	struct brcmnand_controller *ctrl = host->ctrl;
1280 	u32 tmp;
1281 
1282 	tmp = data & LLOP_DATA_MASK;
1283 	switch (type) {
1284 	case LL_OP_CMD:
1285 		tmp |= LLOP_WE | LLOP_CLE;
1286 		break;
1287 	case LL_OP_ADDR:
1288 		/* WE | ALE */
1289 		tmp |= LLOP_WE | LLOP_ALE;
1290 		break;
1291 	case LL_OP_WR:
1292 		/* WE */
1293 		tmp |= LLOP_WE;
1294 		break;
1295 	case LL_OP_RD:
1296 		/* RE */
1297 		tmp |= LLOP_RE;
1298 		break;
1299 	}
1300 	if (last_op)
1301 		/* RETURN_IDLE */
1302 		tmp |= LLOP_RETURN_IDLE;
1303 
1304 	dev_dbg(ctrl->dev, "ll_op cmd %#x\n", tmp);
1305 
1306 	brcmnand_write_reg(ctrl, BRCMNAND_LL_OP, tmp);
1307 	(void)brcmnand_read_reg(ctrl, BRCMNAND_LL_OP);
1308 
1309 	brcmnand_send_cmd(host, CMD_LOW_LEVEL_OP);
1310 	return brcmnand_waitfunc(mtd, chip);
1311 }
1312 
1313 static void brcmnand_cmdfunc(struct mtd_info *mtd, unsigned command,
1314 			     int column, int page_addr)
1315 {
1316 	struct nand_chip *chip = mtd_to_nand(mtd);
1317 	struct brcmnand_host *host = nand_get_controller_data(chip);
1318 	struct brcmnand_controller *ctrl = host->ctrl;
1319 	u64 addr = (u64)page_addr << chip->page_shift;
1320 	int native_cmd = 0;
1321 
1322 	if (command == NAND_CMD_READID || command == NAND_CMD_PARAM ||
1323 			command == NAND_CMD_RNDOUT)
1324 		addr = (u64)column;
1325 	/* Avoid propagating a negative, don't-care address */
1326 	else if (page_addr < 0)
1327 		addr = 0;
1328 
1329 	dev_dbg(ctrl->dev, "cmd 0x%x addr 0x%llx\n", command,
1330 		(unsigned long long)addr);
1331 
1332 	host->last_cmd = command;
1333 	host->last_byte = 0;
1334 	host->last_addr = addr;
1335 
1336 	switch (command) {
1337 	case NAND_CMD_RESET:
1338 		native_cmd = CMD_FLASH_RESET;
1339 		break;
1340 	case NAND_CMD_STATUS:
1341 		native_cmd = CMD_STATUS_READ;
1342 		break;
1343 	case NAND_CMD_READID:
1344 		native_cmd = CMD_DEVICE_ID_READ;
1345 		break;
1346 	case NAND_CMD_READOOB:
1347 		native_cmd = CMD_SPARE_AREA_READ;
1348 		break;
1349 	case NAND_CMD_ERASE1:
1350 		native_cmd = CMD_BLOCK_ERASE;
1351 		brcmnand_wp(mtd, 0);
1352 		break;
1353 	case NAND_CMD_PARAM:
1354 		native_cmd = CMD_PARAMETER_READ;
1355 		break;
1356 	case NAND_CMD_SET_FEATURES:
1357 	case NAND_CMD_GET_FEATURES:
1358 		brcmnand_low_level_op(host, LL_OP_CMD, command, false);
1359 		brcmnand_low_level_op(host, LL_OP_ADDR, column, false);
1360 		break;
1361 	case NAND_CMD_RNDOUT:
1362 		native_cmd = CMD_PARAMETER_CHANGE_COL;
1363 		addr &= ~((u64)(FC_BYTES - 1));
1364 		/*
1365 		 * HW quirk: PARAMETER_CHANGE_COL requires SECTOR_SIZE_1K=0
1366 		 * NB: hwcfg.sector_size_1k may not be initialized yet
1367 		 */
1368 		if (brcmnand_get_sector_size_1k(host)) {
1369 			host->hwcfg.sector_size_1k =
1370 				brcmnand_get_sector_size_1k(host);
1371 			brcmnand_set_sector_size_1k(host, 0);
1372 		}
1373 		break;
1374 	}
1375 
1376 	if (!native_cmd)
1377 		return;
1378 
1379 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
1380 		(host->cs << 16) | ((addr >> 32) & 0xffff));
1381 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
1382 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS, lower_32_bits(addr));
1383 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1384 
1385 	brcmnand_send_cmd(host, native_cmd);
1386 	brcmnand_waitfunc(mtd, chip);
1387 
1388 	if (native_cmd == CMD_PARAMETER_READ ||
1389 			native_cmd == CMD_PARAMETER_CHANGE_COL) {
1390 		/* Copy flash cache word-wise */
1391 		u32 *flash_cache = (u32 *)ctrl->flash_cache;
1392 		int i;
1393 
1394 		brcmnand_soc_data_bus_prepare(ctrl->soc, true);
1395 
1396 		/*
1397 		 * Must cache the FLASH_CACHE now, since changes in
1398 		 * SECTOR_SIZE_1K may invalidate it
1399 		 */
1400 		for (i = 0; i < FC_WORDS; i++)
1401 			/*
1402 			 * Flash cache is big endian for parameter pages, at
1403 			 * least on STB SoCs
1404 			 */
1405 			flash_cache[i] = be32_to_cpu(brcmnand_read_fc(ctrl, i));
1406 
1407 		brcmnand_soc_data_bus_unprepare(ctrl->soc, true);
1408 
1409 		/* Cleanup from HW quirk: restore SECTOR_SIZE_1K */
1410 		if (host->hwcfg.sector_size_1k)
1411 			brcmnand_set_sector_size_1k(host,
1412 						    host->hwcfg.sector_size_1k);
1413 	}
1414 
1415 	/* Re-enable protection is necessary only after erase */
1416 	if (command == NAND_CMD_ERASE1)
1417 		brcmnand_wp(mtd, 1);
1418 }
1419 
1420 static uint8_t brcmnand_read_byte(struct mtd_info *mtd)
1421 {
1422 	struct nand_chip *chip = mtd_to_nand(mtd);
1423 	struct brcmnand_host *host = nand_get_controller_data(chip);
1424 	struct brcmnand_controller *ctrl = host->ctrl;
1425 	uint8_t ret = 0;
1426 	int addr, offs;
1427 
1428 	switch (host->last_cmd) {
1429 	case NAND_CMD_READID:
1430 		if (host->last_byte < 4)
1431 			ret = brcmnand_read_reg(ctrl, BRCMNAND_ID) >>
1432 				(24 - (host->last_byte << 3));
1433 		else if (host->last_byte < 8)
1434 			ret = brcmnand_read_reg(ctrl, BRCMNAND_ID_EXT) >>
1435 				(56 - (host->last_byte << 3));
1436 		break;
1437 
1438 	case NAND_CMD_READOOB:
1439 		ret = oob_reg_read(ctrl, host->last_byte);
1440 		break;
1441 
1442 	case NAND_CMD_STATUS:
1443 		ret = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS) &
1444 					INTFC_FLASH_STATUS;
1445 		if (wp_on) /* hide WP status */
1446 			ret |= NAND_STATUS_WP;
1447 		break;
1448 
1449 	case NAND_CMD_PARAM:
1450 	case NAND_CMD_RNDOUT:
1451 		addr = host->last_addr + host->last_byte;
1452 		offs = addr & (FC_BYTES - 1);
1453 
1454 		/* At FC_BYTES boundary, switch to next column */
1455 		if (host->last_byte > 0 && offs == 0)
1456 			nand_change_read_column_op(chip, addr, NULL, 0, false);
1457 
1458 		ret = ctrl->flash_cache[offs];
1459 		break;
1460 	case NAND_CMD_GET_FEATURES:
1461 		if (host->last_byte >= ONFI_SUBFEATURE_PARAM_LEN) {
1462 			ret = 0;
1463 		} else {
1464 			bool last = host->last_byte ==
1465 				ONFI_SUBFEATURE_PARAM_LEN - 1;
1466 			brcmnand_low_level_op(host, LL_OP_RD, 0, last);
1467 			ret = brcmnand_read_reg(ctrl, BRCMNAND_LL_RDATA) & 0xff;
1468 		}
1469 	}
1470 
1471 	dev_dbg(ctrl->dev, "read byte = 0x%02x\n", ret);
1472 	host->last_byte++;
1473 
1474 	return ret;
1475 }
1476 
1477 static void brcmnand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
1478 {
1479 	int i;
1480 
1481 	for (i = 0; i < len; i++, buf++)
1482 		*buf = brcmnand_read_byte(mtd);
1483 }
1484 
1485 static void brcmnand_write_buf(struct mtd_info *mtd, const uint8_t *buf,
1486 				   int len)
1487 {
1488 	int i;
1489 	struct nand_chip *chip = mtd_to_nand(mtd);
1490 	struct brcmnand_host *host = nand_get_controller_data(chip);
1491 
1492 	switch (host->last_cmd) {
1493 	case NAND_CMD_SET_FEATURES:
1494 		for (i = 0; i < len; i++)
1495 			brcmnand_low_level_op(host, LL_OP_WR, buf[i],
1496 						  (i + 1) == len);
1497 		break;
1498 	default:
1499 		BUG();
1500 		break;
1501 	}
1502 }
1503 
1504 /**
1505  * Construct a FLASH_DMA descriptor as part of a linked list. You must know the
1506  * following ahead of time:
1507  *  - Is this descriptor the beginning or end of a linked list?
1508  *  - What is the (DMA) address of the next descriptor in the linked list?
1509  */
1510 static int brcmnand_fill_dma_desc(struct brcmnand_host *host,
1511 				  struct brcm_nand_dma_desc *desc, u64 addr,
1512 				  dma_addr_t buf, u32 len, u8 dma_cmd,
1513 				  bool begin, bool end,
1514 				  dma_addr_t next_desc)
1515 {
1516 	memset(desc, 0, sizeof(*desc));
1517 	/* Descriptors are written in native byte order (wordwise) */
1518 	desc->next_desc = lower_32_bits(next_desc);
1519 	desc->next_desc_ext = upper_32_bits(next_desc);
1520 	desc->cmd_irq = (dma_cmd << 24) |
1521 		(end ? (0x03 << 8) : 0) | /* IRQ | STOP */
1522 		(!!begin) | ((!!end) << 1); /* head, tail */
1523 #ifdef CONFIG_CPU_BIG_ENDIAN
1524 	desc->cmd_irq |= 0x01 << 12;
1525 #endif
1526 	desc->dram_addr = lower_32_bits(buf);
1527 	desc->dram_addr_ext = upper_32_bits(buf);
1528 	desc->tfr_len = len;
1529 	desc->total_len = len;
1530 	desc->flash_addr = lower_32_bits(addr);
1531 	desc->flash_addr_ext = upper_32_bits(addr);
1532 	desc->cs = host->cs;
1533 	desc->status_valid = 0x01;
1534 	return 0;
1535 }
1536 
1537 /**
1538  * Kick the FLASH_DMA engine, with a given DMA descriptor
1539  */
1540 static void brcmnand_dma_run(struct brcmnand_host *host, dma_addr_t desc)
1541 {
1542 	struct brcmnand_controller *ctrl = host->ctrl;
1543 	unsigned long timeo = msecs_to_jiffies(100);
1544 
1545 	flash_dma_writel(ctrl, FLASH_DMA_FIRST_DESC, lower_32_bits(desc));
1546 	(void)flash_dma_readl(ctrl, FLASH_DMA_FIRST_DESC);
1547 	flash_dma_writel(ctrl, FLASH_DMA_FIRST_DESC_EXT, upper_32_bits(desc));
1548 	(void)flash_dma_readl(ctrl, FLASH_DMA_FIRST_DESC_EXT);
1549 
1550 	/* Start FLASH_DMA engine */
1551 	ctrl->dma_pending = true;
1552 	mb(); /* flush previous writes */
1553 	flash_dma_writel(ctrl, FLASH_DMA_CTRL, 0x03); /* wake | run */
1554 
1555 	if (wait_for_completion_timeout(&ctrl->dma_done, timeo) <= 0) {
1556 		dev_err(ctrl->dev,
1557 				"timeout waiting for DMA; status %#x, error status %#x\n",
1558 				flash_dma_readl(ctrl, FLASH_DMA_STATUS),
1559 				flash_dma_readl(ctrl, FLASH_DMA_ERROR_STATUS));
1560 	}
1561 	ctrl->dma_pending = false;
1562 	flash_dma_writel(ctrl, FLASH_DMA_CTRL, 0); /* force stop */
1563 }
1564 
1565 static int brcmnand_dma_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
1566 			      u32 len, u8 dma_cmd)
1567 {
1568 	struct brcmnand_controller *ctrl = host->ctrl;
1569 	dma_addr_t buf_pa;
1570 	int dir = dma_cmd == CMD_PAGE_READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
1571 
1572 	buf_pa = dma_map_single(ctrl->dev, buf, len, dir);
1573 	if (dma_mapping_error(ctrl->dev, buf_pa)) {
1574 		dev_err(ctrl->dev, "unable to map buffer for DMA\n");
1575 		return -ENOMEM;
1576 	}
1577 
1578 	brcmnand_fill_dma_desc(host, ctrl->dma_desc, addr, buf_pa, len,
1579 				   dma_cmd, true, true, 0);
1580 
1581 	brcmnand_dma_run(host, ctrl->dma_pa);
1582 
1583 	dma_unmap_single(ctrl->dev, buf_pa, len, dir);
1584 
1585 	if (ctrl->dma_desc->status_valid & FLASH_DMA_ECC_ERROR)
1586 		return -EBADMSG;
1587 	else if (ctrl->dma_desc->status_valid & FLASH_DMA_CORR_ERROR)
1588 		return -EUCLEAN;
1589 
1590 	return 0;
1591 }
1592 
1593 /*
1594  * Assumes proper CS is already set
1595  */
1596 static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
1597 				u64 addr, unsigned int trans, u32 *buf,
1598 				u8 *oob, u64 *err_addr)
1599 {
1600 	struct brcmnand_host *host = nand_get_controller_data(chip);
1601 	struct brcmnand_controller *ctrl = host->ctrl;
1602 	int i, j, ret = 0;
1603 
1604 	/* Clear error addresses */
1605 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
1606 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
1607 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
1608 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
1609 
1610 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
1611 			(host->cs << 16) | ((addr >> 32) & 0xffff));
1612 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
1613 
1614 	for (i = 0; i < trans; i++, addr += FC_BYTES) {
1615 		brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
1616 				   lower_32_bits(addr));
1617 		(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1618 		/* SPARE_AREA_READ does not use ECC, so just use PAGE_READ */
1619 		brcmnand_send_cmd(host, CMD_PAGE_READ);
1620 		brcmnand_waitfunc(mtd, chip);
1621 
1622 		if (likely(buf)) {
1623 			brcmnand_soc_data_bus_prepare(ctrl->soc, false);
1624 
1625 			for (j = 0; j < FC_WORDS; j++, buf++)
1626 				*buf = brcmnand_read_fc(ctrl, j);
1627 
1628 			brcmnand_soc_data_bus_unprepare(ctrl->soc, false);
1629 		}
1630 
1631 		if (oob)
1632 			oob += read_oob_from_regs(ctrl, i, oob,
1633 					mtd->oobsize / trans,
1634 					host->hwcfg.sector_size_1k);
1635 
1636 		if (!ret) {
1637 			*err_addr = brcmnand_read_reg(ctrl,
1638 					BRCMNAND_UNCORR_ADDR) |
1639 				((u64)(brcmnand_read_reg(ctrl,
1640 						BRCMNAND_UNCORR_EXT_ADDR)
1641 					& 0xffff) << 32);
1642 			if (*err_addr)
1643 				ret = -EBADMSG;
1644 		}
1645 
1646 		if (!ret) {
1647 			*err_addr = brcmnand_read_reg(ctrl,
1648 					BRCMNAND_CORR_ADDR) |
1649 				((u64)(brcmnand_read_reg(ctrl,
1650 						BRCMNAND_CORR_EXT_ADDR)
1651 					& 0xffff) << 32);
1652 			if (*err_addr)
1653 				ret = -EUCLEAN;
1654 		}
1655 	}
1656 
1657 	return ret;
1658 }
1659 
1660 /*
1661  * Check a page to see if it is erased (w/ bitflips) after an uncorrectable ECC
1662  * error
1663  *
1664  * Because the HW ECC signals an ECC error if an erase paged has even a single
1665  * bitflip, we must check each ECC error to see if it is actually an erased
1666  * page with bitflips, not a truly corrupted page.
1667  *
1668  * On a real error, return a negative error code (-EBADMSG for ECC error), and
1669  * buf will contain raw data.
1670  * Otherwise, buf gets filled with 0xffs and return the maximum number of
1671  * bitflips-per-ECC-sector to the caller.
1672  *
1673  */
1674 static int brcmstb_nand_verify_erased_page(struct mtd_info *mtd,
1675 		  struct nand_chip *chip, void *buf, u64 addr)
1676 {
1677 	int i, sas;
1678 	void *oob = chip->oob_poi;
1679 	int bitflips = 0;
1680 	int page = addr >> chip->page_shift;
1681 	int ret;
1682 
1683 	if (!buf) {
1684 		buf = chip->data_buf;
1685 		/* Invalidate page cache */
1686 		chip->pagebuf = -1;
1687 	}
1688 
1689 	sas = mtd->oobsize / chip->ecc.steps;
1690 
1691 	/* read without ecc for verification */
1692 	ret = chip->ecc.read_page_raw(mtd, chip, buf, true, page);
1693 	if (ret)
1694 		return ret;
1695 
1696 	for (i = 0; i < chip->ecc.steps; i++, oob += sas) {
1697 		ret = nand_check_erased_ecc_chunk(buf, chip->ecc.size,
1698 						  oob, sas, NULL, 0,
1699 						  chip->ecc.strength);
1700 		if (ret < 0)
1701 			return ret;
1702 
1703 		bitflips = max(bitflips, ret);
1704 	}
1705 
1706 	return bitflips;
1707 }
1708 
1709 static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
1710 			 u64 addr, unsigned int trans, u32 *buf, u8 *oob)
1711 {
1712 	struct brcmnand_host *host = nand_get_controller_data(chip);
1713 	struct brcmnand_controller *ctrl = host->ctrl;
1714 	u64 err_addr = 0;
1715 	int err;
1716 	bool retry = true;
1717 
1718 	dev_dbg(ctrl->dev, "read %llx -> %p\n", (unsigned long long)addr, buf);
1719 
1720 try_dmaread:
1721 	brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_COUNT, 0);
1722 
1723 	if (has_flash_dma(ctrl) && !oob && flash_dma_buf_ok(buf)) {
1724 		err = brcmnand_dma_trans(host, addr, buf, trans * FC_BYTES,
1725 					     CMD_PAGE_READ);
1726 		if (err) {
1727 			if (mtd_is_bitflip_or_eccerr(err))
1728 				err_addr = addr;
1729 			else
1730 				return -EIO;
1731 		}
1732 	} else {
1733 		if (oob)
1734 			memset(oob, 0x99, mtd->oobsize);
1735 
1736 		err = brcmnand_read_by_pio(mtd, chip, addr, trans, buf,
1737 					       oob, &err_addr);
1738 	}
1739 
1740 	if (mtd_is_eccerr(err)) {
1741 		/*
1742 		 * On controller version and 7.0, 7.1 , DMA read after a
1743 		 * prior PIO read that reported uncorrectable error,
1744 		 * the DMA engine captures this error following DMA read
1745 		 * cleared only on subsequent DMA read, so just retry once
1746 		 * to clear a possible false error reported for current DMA
1747 		 * read
1748 		 */
1749 		if ((ctrl->nand_version == 0x0700) ||
1750 		    (ctrl->nand_version == 0x0701)) {
1751 			if (retry) {
1752 				retry = false;
1753 				goto try_dmaread;
1754 			}
1755 		}
1756 
1757 		/*
1758 		 * Controller version 7.2 has hw encoder to detect erased page
1759 		 * bitflips, apply sw verification for older controllers only
1760 		 */
1761 		if (ctrl->nand_version < 0x0702) {
1762 			err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
1763 							      addr);
1764 			/* erased page bitflips corrected */
1765 			if (err >= 0)
1766 				return err;
1767 		}
1768 
1769 		dev_dbg(ctrl->dev, "uncorrectable error at 0x%llx\n",
1770 			(unsigned long long)err_addr);
1771 		mtd->ecc_stats.failed++;
1772 		/* NAND layer expects zero on ECC errors */
1773 		return 0;
1774 	}
1775 
1776 	if (mtd_is_bitflip(err)) {
1777 		unsigned int corrected = brcmnand_count_corrected(ctrl);
1778 
1779 		dev_dbg(ctrl->dev, "corrected error at 0x%llx\n",
1780 			(unsigned long long)err_addr);
1781 		mtd->ecc_stats.corrected += corrected;
1782 		/* Always exceed the software-imposed threshold */
1783 		return max(mtd->bitflip_threshold, corrected);
1784 	}
1785 
1786 	return 0;
1787 }
1788 
1789 static int brcmnand_read_page(struct mtd_info *mtd, struct nand_chip *chip,
1790 			      uint8_t *buf, int oob_required, int page)
1791 {
1792 	struct brcmnand_host *host = nand_get_controller_data(chip);
1793 	u8 *oob = oob_required ? (u8 *)chip->oob_poi : NULL;
1794 
1795 	nand_read_page_op(chip, page, 0, NULL, 0);
1796 
1797 	return brcmnand_read(mtd, chip, host->last_addr,
1798 			mtd->writesize >> FC_SHIFT, (u32 *)buf, oob);
1799 }
1800 
1801 static int brcmnand_read_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
1802 				  uint8_t *buf, int oob_required, int page)
1803 {
1804 	struct brcmnand_host *host = nand_get_controller_data(chip);
1805 	u8 *oob = oob_required ? (u8 *)chip->oob_poi : NULL;
1806 	int ret;
1807 
1808 	nand_read_page_op(chip, page, 0, NULL, 0);
1809 
1810 	brcmnand_set_ecc_enabled(host, 0);
1811 	ret = brcmnand_read(mtd, chip, host->last_addr,
1812 			mtd->writesize >> FC_SHIFT, (u32 *)buf, oob);
1813 	brcmnand_set_ecc_enabled(host, 1);
1814 	return ret;
1815 }
1816 
1817 static int brcmnand_read_oob(struct mtd_info *mtd, struct nand_chip *chip,
1818 			     int page)
1819 {
1820 	return brcmnand_read(mtd, chip, (u64)page << chip->page_shift,
1821 			mtd->writesize >> FC_SHIFT,
1822 			NULL, (u8 *)chip->oob_poi);
1823 }
1824 
1825 static int brcmnand_read_oob_raw(struct mtd_info *mtd, struct nand_chip *chip,
1826 				 int page)
1827 {
1828 	struct brcmnand_host *host = nand_get_controller_data(chip);
1829 
1830 	brcmnand_set_ecc_enabled(host, 0);
1831 	brcmnand_read(mtd, chip, (u64)page << chip->page_shift,
1832 		mtd->writesize >> FC_SHIFT,
1833 		NULL, (u8 *)chip->oob_poi);
1834 	brcmnand_set_ecc_enabled(host, 1);
1835 	return 0;
1836 }
1837 
1838 static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
1839 			  u64 addr, const u32 *buf, u8 *oob)
1840 {
1841 	struct brcmnand_host *host = nand_get_controller_data(chip);
1842 	struct brcmnand_controller *ctrl = host->ctrl;
1843 	unsigned int i, j, trans = mtd->writesize >> FC_SHIFT;
1844 	int status, ret = 0;
1845 
1846 	dev_dbg(ctrl->dev, "write %llx <- %p\n", (unsigned long long)addr, buf);
1847 
1848 	if (unlikely((unsigned long)buf & 0x03)) {
1849 		dev_warn(ctrl->dev, "unaligned buffer: %p\n", buf);
1850 		buf = (u32 *)((unsigned long)buf & ~0x03);
1851 	}
1852 
1853 	brcmnand_wp(mtd, 0);
1854 
1855 	for (i = 0; i < ctrl->max_oob; i += 4)
1856 		oob_reg_write(ctrl, i, 0xffffffff);
1857 
1858 	if (has_flash_dma(ctrl) && !oob && flash_dma_buf_ok(buf)) {
1859 		if (brcmnand_dma_trans(host, addr, (u32 *)buf,
1860 					mtd->writesize, CMD_PROGRAM_PAGE))
1861 			ret = -EIO;
1862 		goto out;
1863 	}
1864 
1865 	brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
1866 			(host->cs << 16) | ((addr >> 32) & 0xffff));
1867 	(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
1868 
1869 	for (i = 0; i < trans; i++, addr += FC_BYTES) {
1870 		/* full address MUST be set before populating FC */
1871 		brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
1872 				   lower_32_bits(addr));
1873 		(void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
1874 
1875 		if (buf) {
1876 			brcmnand_soc_data_bus_prepare(ctrl->soc, false);
1877 
1878 			for (j = 0; j < FC_WORDS; j++, buf++)
1879 				brcmnand_write_fc(ctrl, j, *buf);
1880 
1881 			brcmnand_soc_data_bus_unprepare(ctrl->soc, false);
1882 		} else if (oob) {
1883 			for (j = 0; j < FC_WORDS; j++)
1884 				brcmnand_write_fc(ctrl, j, 0xffffffff);
1885 		}
1886 
1887 		if (oob) {
1888 			oob += write_oob_to_regs(ctrl, i, oob,
1889 					mtd->oobsize / trans,
1890 					host->hwcfg.sector_size_1k);
1891 		}
1892 
1893 		/* we cannot use SPARE_AREA_PROGRAM when PARTIAL_PAGE_EN=0 */
1894 		brcmnand_send_cmd(host, CMD_PROGRAM_PAGE);
1895 		status = brcmnand_waitfunc(mtd, chip);
1896 
1897 		if (status & NAND_STATUS_FAIL) {
1898 			dev_info(ctrl->dev, "program failed at %llx\n",
1899 				(unsigned long long)addr);
1900 			ret = -EIO;
1901 			goto out;
1902 		}
1903 	}
1904 out:
1905 	brcmnand_wp(mtd, 1);
1906 	return ret;
1907 }
1908 
1909 static int brcmnand_write_page(struct mtd_info *mtd, struct nand_chip *chip,
1910 			       const uint8_t *buf, int oob_required, int page)
1911 {
1912 	struct brcmnand_host *host = nand_get_controller_data(chip);
1913 	void *oob = oob_required ? chip->oob_poi : NULL;
1914 
1915 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
1916 	brcmnand_write(mtd, chip, host->last_addr, (const u32 *)buf, oob);
1917 
1918 	return nand_prog_page_end_op(chip);
1919 }
1920 
1921 static int brcmnand_write_page_raw(struct mtd_info *mtd,
1922 				   struct nand_chip *chip, const uint8_t *buf,
1923 				   int oob_required, int page)
1924 {
1925 	struct brcmnand_host *host = nand_get_controller_data(chip);
1926 	void *oob = oob_required ? chip->oob_poi : NULL;
1927 
1928 	nand_prog_page_begin_op(chip, page, 0, NULL, 0);
1929 	brcmnand_set_ecc_enabled(host, 0);
1930 	brcmnand_write(mtd, chip, host->last_addr, (const u32 *)buf, oob);
1931 	brcmnand_set_ecc_enabled(host, 1);
1932 
1933 	return nand_prog_page_end_op(chip);
1934 }
1935 
1936 static int brcmnand_write_oob(struct mtd_info *mtd, struct nand_chip *chip,
1937 				  int page)
1938 {
1939 	return brcmnand_write(mtd, chip, (u64)page << chip->page_shift,
1940 				  NULL, chip->oob_poi);
1941 }
1942 
1943 static int brcmnand_write_oob_raw(struct mtd_info *mtd, struct nand_chip *chip,
1944 				  int page)
1945 {
1946 	struct brcmnand_host *host = nand_get_controller_data(chip);
1947 	int ret;
1948 
1949 	brcmnand_set_ecc_enabled(host, 0);
1950 	ret = brcmnand_write(mtd, chip, (u64)page << chip->page_shift, NULL,
1951 				 (u8 *)chip->oob_poi);
1952 	brcmnand_set_ecc_enabled(host, 1);
1953 
1954 	return ret;
1955 }
1956 
1957 /***********************************************************************
1958  * Per-CS setup (1 NAND device)
1959  ***********************************************************************/
1960 
1961 static int brcmnand_set_cfg(struct brcmnand_host *host,
1962 			    struct brcmnand_cfg *cfg)
1963 {
1964 	struct brcmnand_controller *ctrl = host->ctrl;
1965 	struct nand_chip *chip = &host->chip;
1966 	u16 cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
1967 	u16 cfg_ext_offs = brcmnand_cs_offset(ctrl, host->cs,
1968 			BRCMNAND_CS_CFG_EXT);
1969 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
1970 			BRCMNAND_CS_ACC_CONTROL);
1971 	u8 block_size = 0, page_size = 0, device_size = 0;
1972 	u32 tmp;
1973 
1974 	if (ctrl->block_sizes) {
1975 		int i, found;
1976 
1977 		for (i = 0, found = 0; ctrl->block_sizes[i]; i++)
1978 			if (ctrl->block_sizes[i] * 1024 == cfg->block_size) {
1979 				block_size = i;
1980 				found = 1;
1981 			}
1982 		if (!found) {
1983 			dev_warn(ctrl->dev, "invalid block size %u\n",
1984 					cfg->block_size);
1985 			return -EINVAL;
1986 		}
1987 	} else {
1988 		block_size = ffs(cfg->block_size) - ffs(BRCMNAND_MIN_BLOCKSIZE);
1989 	}
1990 
1991 	if (cfg->block_size < BRCMNAND_MIN_BLOCKSIZE || (ctrl->max_block_size &&
1992 				cfg->block_size > ctrl->max_block_size)) {
1993 		dev_warn(ctrl->dev, "invalid block size %u\n",
1994 				cfg->block_size);
1995 		block_size = 0;
1996 	}
1997 
1998 	if (ctrl->page_sizes) {
1999 		int i, found;
2000 
2001 		for (i = 0, found = 0; ctrl->page_sizes[i]; i++)
2002 			if (ctrl->page_sizes[i] == cfg->page_size) {
2003 				page_size = i;
2004 				found = 1;
2005 			}
2006 		if (!found) {
2007 			dev_warn(ctrl->dev, "invalid page size %u\n",
2008 					cfg->page_size);
2009 			return -EINVAL;
2010 		}
2011 	} else {
2012 		page_size = ffs(cfg->page_size) - ffs(BRCMNAND_MIN_PAGESIZE);
2013 	}
2014 
2015 	if (cfg->page_size < BRCMNAND_MIN_PAGESIZE || (ctrl->max_page_size &&
2016 				cfg->page_size > ctrl->max_page_size)) {
2017 		dev_warn(ctrl->dev, "invalid page size %u\n", cfg->page_size);
2018 		return -EINVAL;
2019 	}
2020 
2021 	if (fls64(cfg->device_size) < fls64(BRCMNAND_MIN_DEVSIZE)) {
2022 		dev_warn(ctrl->dev, "invalid device size 0x%llx\n",
2023 			(unsigned long long)cfg->device_size);
2024 		return -EINVAL;
2025 	}
2026 	device_size = fls64(cfg->device_size) - fls64(BRCMNAND_MIN_DEVSIZE);
2027 
2028 	tmp = (cfg->blk_adr_bytes << CFG_BLK_ADR_BYTES_SHIFT) |
2029 		(cfg->col_adr_bytes << CFG_COL_ADR_BYTES_SHIFT) |
2030 		(cfg->ful_adr_bytes << CFG_FUL_ADR_BYTES_SHIFT) |
2031 		(!!(cfg->device_width == 16) << CFG_BUS_WIDTH_SHIFT) |
2032 		(device_size << CFG_DEVICE_SIZE_SHIFT);
2033 	if (cfg_offs == cfg_ext_offs) {
2034 		tmp |= (page_size << CFG_PAGE_SIZE_SHIFT) |
2035 		       (block_size << CFG_BLK_SIZE_SHIFT);
2036 		nand_writereg(ctrl, cfg_offs, tmp);
2037 	} else {
2038 		nand_writereg(ctrl, cfg_offs, tmp);
2039 		tmp = (page_size << CFG_EXT_PAGE_SIZE_SHIFT) |
2040 		      (block_size << CFG_EXT_BLK_SIZE_SHIFT);
2041 		nand_writereg(ctrl, cfg_ext_offs, tmp);
2042 	}
2043 
2044 	tmp = nand_readreg(ctrl, acc_control_offs);
2045 	tmp &= ~brcmnand_ecc_level_mask(ctrl);
2046 	tmp |= cfg->ecc_level << NAND_ACC_CONTROL_ECC_SHIFT;
2047 	tmp &= ~brcmnand_spare_area_mask(ctrl);
2048 	tmp |= cfg->spare_area_size;
2049 	nand_writereg(ctrl, acc_control_offs, tmp);
2050 
2051 	brcmnand_set_sector_size_1k(host, cfg->sector_size_1k);
2052 
2053 	/* threshold = ceil(BCH-level * 0.75) */
2054 	brcmnand_wr_corr_thresh(host, DIV_ROUND_UP(chip->ecc.strength * 3, 4));
2055 
2056 	return 0;
2057 }
2058 
2059 static void brcmnand_print_cfg(struct brcmnand_host *host,
2060 			       char *buf, struct brcmnand_cfg *cfg)
2061 {
2062 	buf += sprintf(buf,
2063 		"%lluMiB total, %uKiB blocks, %u%s pages, %uB OOB, %u-bit",
2064 		(unsigned long long)cfg->device_size >> 20,
2065 		cfg->block_size >> 10,
2066 		cfg->page_size >= 1024 ? cfg->page_size >> 10 : cfg->page_size,
2067 		cfg->page_size >= 1024 ? "KiB" : "B",
2068 		cfg->spare_area_size, cfg->device_width);
2069 
2070 	/* Account for Hamming ECC and for BCH 512B vs 1KiB sectors */
2071 	if (is_hamming_ecc(host->ctrl, cfg))
2072 		sprintf(buf, ", Hamming ECC");
2073 	else if (cfg->sector_size_1k)
2074 		sprintf(buf, ", BCH-%u (1KiB sector)", cfg->ecc_level << 1);
2075 	else
2076 		sprintf(buf, ", BCH-%u", cfg->ecc_level);
2077 }
2078 
2079 /*
2080  * Minimum number of bytes to address a page. Calculated as:
2081  *     roundup(log2(size / page-size) / 8)
2082  *
2083  * NB: the following does not "round up" for non-power-of-2 'size'; but this is
2084  *     OK because many other things will break if 'size' is irregular...
2085  */
2086 static inline int get_blk_adr_bytes(u64 size, u32 writesize)
2087 {
2088 	return ALIGN(ilog2(size) - ilog2(writesize), 8) >> 3;
2089 }
2090 
2091 static int brcmnand_setup_dev(struct brcmnand_host *host)
2092 {
2093 	struct mtd_info *mtd = nand_to_mtd(&host->chip);
2094 	struct nand_chip *chip = &host->chip;
2095 	struct brcmnand_controller *ctrl = host->ctrl;
2096 	struct brcmnand_cfg *cfg = &host->hwcfg;
2097 	char msg[128];
2098 	u32 offs, tmp, oob_sector;
2099 	int ret;
2100 
2101 	memset(cfg, 0, sizeof(*cfg));
2102 
2103 	ret = of_property_read_u32(nand_get_flash_node(chip),
2104 				   "brcm,nand-oob-sector-size",
2105 				   &oob_sector);
2106 	if (ret) {
2107 		/* Use detected size */
2108 		cfg->spare_area_size = mtd->oobsize /
2109 					(mtd->writesize >> FC_SHIFT);
2110 	} else {
2111 		cfg->spare_area_size = oob_sector;
2112 	}
2113 	if (cfg->spare_area_size > ctrl->max_oob)
2114 		cfg->spare_area_size = ctrl->max_oob;
2115 	/*
2116 	 * Set oobsize to be consistent with controller's spare_area_size, as
2117 	 * the rest is inaccessible.
2118 	 */
2119 	mtd->oobsize = cfg->spare_area_size * (mtd->writesize >> FC_SHIFT);
2120 
2121 	cfg->device_size = mtd->size;
2122 	cfg->block_size = mtd->erasesize;
2123 	cfg->page_size = mtd->writesize;
2124 	cfg->device_width = (chip->options & NAND_BUSWIDTH_16) ? 16 : 8;
2125 	cfg->col_adr_bytes = 2;
2126 	cfg->blk_adr_bytes = get_blk_adr_bytes(mtd->size, mtd->writesize);
2127 
2128 	if (chip->ecc.mode != NAND_ECC_HW) {
2129 		dev_err(ctrl->dev, "only HW ECC supported; selected: %d\n",
2130 			chip->ecc.mode);
2131 		return -EINVAL;
2132 	}
2133 
2134 	if (chip->ecc.algo == NAND_ECC_UNKNOWN) {
2135 		if (chip->ecc.strength == 1 && chip->ecc.size == 512)
2136 			/* Default to Hamming for 1-bit ECC, if unspecified */
2137 			chip->ecc.algo = NAND_ECC_HAMMING;
2138 		else
2139 			/* Otherwise, BCH */
2140 			chip->ecc.algo = NAND_ECC_BCH;
2141 	}
2142 
2143 	if (chip->ecc.algo == NAND_ECC_HAMMING && (chip->ecc.strength != 1 ||
2144 						   chip->ecc.size != 512)) {
2145 		dev_err(ctrl->dev, "invalid Hamming params: %d bits per %d bytes\n",
2146 			chip->ecc.strength, chip->ecc.size);
2147 		return -EINVAL;
2148 	}
2149 
2150 	switch (chip->ecc.size) {
2151 	case 512:
2152 		if (chip->ecc.algo == NAND_ECC_HAMMING)
2153 			cfg->ecc_level = 15;
2154 		else
2155 			cfg->ecc_level = chip->ecc.strength;
2156 		cfg->sector_size_1k = 0;
2157 		break;
2158 	case 1024:
2159 		if (!(ctrl->features & BRCMNAND_HAS_1K_SECTORS)) {
2160 			dev_err(ctrl->dev, "1KB sectors not supported\n");
2161 			return -EINVAL;
2162 		}
2163 		if (chip->ecc.strength & 0x1) {
2164 			dev_err(ctrl->dev,
2165 				"odd ECC not supported with 1KB sectors\n");
2166 			return -EINVAL;
2167 		}
2168 
2169 		cfg->ecc_level = chip->ecc.strength >> 1;
2170 		cfg->sector_size_1k = 1;
2171 		break;
2172 	default:
2173 		dev_err(ctrl->dev, "unsupported ECC size: %d\n",
2174 			chip->ecc.size);
2175 		return -EINVAL;
2176 	}
2177 
2178 	cfg->ful_adr_bytes = cfg->blk_adr_bytes;
2179 	if (mtd->writesize > 512)
2180 		cfg->ful_adr_bytes += cfg->col_adr_bytes;
2181 	else
2182 		cfg->ful_adr_bytes += 1;
2183 
2184 	ret = brcmnand_set_cfg(host, cfg);
2185 	if (ret)
2186 		return ret;
2187 
2188 	brcmnand_set_ecc_enabled(host, 1);
2189 
2190 	brcmnand_print_cfg(host, msg, cfg);
2191 	dev_info(ctrl->dev, "detected %s\n", msg);
2192 
2193 	/* Configure ACC_CONTROL */
2194 	offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_ACC_CONTROL);
2195 	tmp = nand_readreg(ctrl, offs);
2196 	tmp &= ~ACC_CONTROL_PARTIAL_PAGE;
2197 	tmp &= ~ACC_CONTROL_RD_ERASED;
2198 
2199 	/* We need to turn on Read from erased paged protected by ECC */
2200 	if (ctrl->nand_version >= 0x0702)
2201 		tmp |= ACC_CONTROL_RD_ERASED;
2202 	tmp &= ~ACC_CONTROL_FAST_PGM_RDIN;
2203 	if (ctrl->features & BRCMNAND_HAS_PREFETCH)
2204 		tmp &= ~ACC_CONTROL_PREFETCH;
2205 
2206 	nand_writereg(ctrl, offs, tmp);
2207 
2208 	return 0;
2209 }
2210 
2211 static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
2212 {
2213 	struct brcmnand_controller *ctrl = host->ctrl;
2214 	struct platform_device *pdev = host->pdev;
2215 	struct mtd_info *mtd;
2216 	struct nand_chip *chip;
2217 	int ret;
2218 	u16 cfg_offs;
2219 
2220 	ret = of_property_read_u32(dn, "reg", &host->cs);
2221 	if (ret) {
2222 		dev_err(&pdev->dev, "can't get chip-select\n");
2223 		return -ENXIO;
2224 	}
2225 
2226 	mtd = nand_to_mtd(&host->chip);
2227 	chip = &host->chip;
2228 
2229 	nand_set_flash_node(chip, dn);
2230 	nand_set_controller_data(chip, host);
2231 	mtd->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "brcmnand.%d",
2232 				   host->cs);
2233 	if (!mtd->name)
2234 		return -ENOMEM;
2235 
2236 	mtd->owner = THIS_MODULE;
2237 	mtd->dev.parent = &pdev->dev;
2238 
2239 	chip->IO_ADDR_R = (void __iomem *)0xdeadbeef;
2240 	chip->IO_ADDR_W = (void __iomem *)0xdeadbeef;
2241 
2242 	chip->cmd_ctrl = brcmnand_cmd_ctrl;
2243 	chip->cmdfunc = brcmnand_cmdfunc;
2244 	chip->waitfunc = brcmnand_waitfunc;
2245 	chip->read_byte = brcmnand_read_byte;
2246 	chip->read_buf = brcmnand_read_buf;
2247 	chip->write_buf = brcmnand_write_buf;
2248 
2249 	chip->ecc.mode = NAND_ECC_HW;
2250 	chip->ecc.read_page = brcmnand_read_page;
2251 	chip->ecc.write_page = brcmnand_write_page;
2252 	chip->ecc.read_page_raw = brcmnand_read_page_raw;
2253 	chip->ecc.write_page_raw = brcmnand_write_page_raw;
2254 	chip->ecc.write_oob_raw = brcmnand_write_oob_raw;
2255 	chip->ecc.read_oob_raw = brcmnand_read_oob_raw;
2256 	chip->ecc.read_oob = brcmnand_read_oob;
2257 	chip->ecc.write_oob = brcmnand_write_oob;
2258 
2259 	chip->controller = &ctrl->controller;
2260 
2261 	/*
2262 	 * The bootloader might have configured 16bit mode but
2263 	 * NAND READID command only works in 8bit mode. We force
2264 	 * 8bit mode here to ensure that NAND READID commands works.
2265 	 */
2266 	cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2267 	nand_writereg(ctrl, cfg_offs,
2268 		      nand_readreg(ctrl, cfg_offs) & ~CFG_BUS_WIDTH);
2269 
2270 	ret = nand_scan_ident(mtd, 1, NULL);
2271 	if (ret)
2272 		return ret;
2273 
2274 	chip->options |= NAND_NO_SUBPAGE_WRITE;
2275 	/*
2276 	 * Avoid (for instance) kmap()'d buffers from JFFS2, which we can't DMA
2277 	 * to/from, and have nand_base pass us a bounce buffer instead, as
2278 	 * needed.
2279 	 */
2280 	chip->options |= NAND_USE_BOUNCE_BUFFER;
2281 
2282 	if (chip->bbt_options & NAND_BBT_USE_FLASH)
2283 		chip->bbt_options |= NAND_BBT_NO_OOB;
2284 
2285 	if (brcmnand_setup_dev(host))
2286 		return -ENXIO;
2287 
2288 	chip->ecc.size = host->hwcfg.sector_size_1k ? 1024 : 512;
2289 	/* only use our internal HW threshold */
2290 	mtd->bitflip_threshold = 1;
2291 
2292 	ret = brcmstb_choose_ecc_layout(host);
2293 	if (ret)
2294 		return ret;
2295 
2296 	ret = nand_scan_tail(mtd);
2297 	if (ret)
2298 		return ret;
2299 
2300 	ret = mtd_device_register(mtd, NULL, 0);
2301 	if (ret)
2302 		nand_cleanup(chip);
2303 
2304 	return ret;
2305 }
2306 
2307 static void brcmnand_save_restore_cs_config(struct brcmnand_host *host,
2308 					    int restore)
2309 {
2310 	struct brcmnand_controller *ctrl = host->ctrl;
2311 	u16 cfg_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_CFG);
2312 	u16 cfg_ext_offs = brcmnand_cs_offset(ctrl, host->cs,
2313 			BRCMNAND_CS_CFG_EXT);
2314 	u16 acc_control_offs = brcmnand_cs_offset(ctrl, host->cs,
2315 			BRCMNAND_CS_ACC_CONTROL);
2316 	u16 t1_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_TIMING1);
2317 	u16 t2_offs = brcmnand_cs_offset(ctrl, host->cs, BRCMNAND_CS_TIMING2);
2318 
2319 	if (restore) {
2320 		nand_writereg(ctrl, cfg_offs, host->hwcfg.config);
2321 		if (cfg_offs != cfg_ext_offs)
2322 			nand_writereg(ctrl, cfg_ext_offs,
2323 				      host->hwcfg.config_ext);
2324 		nand_writereg(ctrl, acc_control_offs, host->hwcfg.acc_control);
2325 		nand_writereg(ctrl, t1_offs, host->hwcfg.timing_1);
2326 		nand_writereg(ctrl, t2_offs, host->hwcfg.timing_2);
2327 	} else {
2328 		host->hwcfg.config = nand_readreg(ctrl, cfg_offs);
2329 		if (cfg_offs != cfg_ext_offs)
2330 			host->hwcfg.config_ext =
2331 				nand_readreg(ctrl, cfg_ext_offs);
2332 		host->hwcfg.acc_control = nand_readreg(ctrl, acc_control_offs);
2333 		host->hwcfg.timing_1 = nand_readreg(ctrl, t1_offs);
2334 		host->hwcfg.timing_2 = nand_readreg(ctrl, t2_offs);
2335 	}
2336 }
2337 
2338 static int brcmnand_suspend(struct device *dev)
2339 {
2340 	struct brcmnand_controller *ctrl = dev_get_drvdata(dev);
2341 	struct brcmnand_host *host;
2342 
2343 	list_for_each_entry(host, &ctrl->host_list, node)
2344 		brcmnand_save_restore_cs_config(host, 0);
2345 
2346 	ctrl->nand_cs_nand_select = brcmnand_read_reg(ctrl, BRCMNAND_CS_SELECT);
2347 	ctrl->nand_cs_nand_xor = brcmnand_read_reg(ctrl, BRCMNAND_CS_XOR);
2348 	ctrl->corr_stat_threshold =
2349 		brcmnand_read_reg(ctrl, BRCMNAND_CORR_THRESHOLD);
2350 
2351 	if (has_flash_dma(ctrl))
2352 		ctrl->flash_dma_mode = flash_dma_readl(ctrl, FLASH_DMA_MODE);
2353 
2354 	return 0;
2355 }
2356 
2357 static int brcmnand_resume(struct device *dev)
2358 {
2359 	struct brcmnand_controller *ctrl = dev_get_drvdata(dev);
2360 	struct brcmnand_host *host;
2361 
2362 	if (has_flash_dma(ctrl)) {
2363 		flash_dma_writel(ctrl, FLASH_DMA_MODE, ctrl->flash_dma_mode);
2364 		flash_dma_writel(ctrl, FLASH_DMA_ERROR_STATUS, 0);
2365 	}
2366 
2367 	brcmnand_write_reg(ctrl, BRCMNAND_CS_SELECT, ctrl->nand_cs_nand_select);
2368 	brcmnand_write_reg(ctrl, BRCMNAND_CS_XOR, ctrl->nand_cs_nand_xor);
2369 	brcmnand_write_reg(ctrl, BRCMNAND_CORR_THRESHOLD,
2370 			ctrl->corr_stat_threshold);
2371 	if (ctrl->soc) {
2372 		/* Clear/re-enable interrupt */
2373 		ctrl->soc->ctlrdy_ack(ctrl->soc);
2374 		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
2375 	}
2376 
2377 	list_for_each_entry(host, &ctrl->host_list, node) {
2378 		struct nand_chip *chip = &host->chip;
2379 
2380 		brcmnand_save_restore_cs_config(host, 1);
2381 
2382 		/* Reset the chip, required by some chips after power-up */
2383 		nand_reset_op(chip);
2384 	}
2385 
2386 	return 0;
2387 }
2388 
2389 const struct dev_pm_ops brcmnand_pm_ops = {
2390 	.suspend		= brcmnand_suspend,
2391 	.resume			= brcmnand_resume,
2392 };
2393 EXPORT_SYMBOL_GPL(brcmnand_pm_ops);
2394 
2395 static const struct of_device_id brcmnand_of_match[] = {
2396 	{ .compatible = "brcm,brcmnand-v4.0" },
2397 	{ .compatible = "brcm,brcmnand-v5.0" },
2398 	{ .compatible = "brcm,brcmnand-v6.0" },
2399 	{ .compatible = "brcm,brcmnand-v6.1" },
2400 	{ .compatible = "brcm,brcmnand-v6.2" },
2401 	{ .compatible = "brcm,brcmnand-v7.0" },
2402 	{ .compatible = "brcm,brcmnand-v7.1" },
2403 	{ .compatible = "brcm,brcmnand-v7.2" },
2404 	{},
2405 };
2406 MODULE_DEVICE_TABLE(of, brcmnand_of_match);
2407 
2408 /***********************************************************************
2409  * Platform driver setup (per controller)
2410  ***********************************************************************/
2411 
2412 int brcmnand_probe(struct platform_device *pdev, struct brcmnand_soc *soc)
2413 {
2414 	struct device *dev = &pdev->dev;
2415 	struct device_node *dn = dev->of_node, *child;
2416 	struct brcmnand_controller *ctrl;
2417 	struct resource *res;
2418 	int ret;
2419 
2420 	/* We only support device-tree instantiation */
2421 	if (!dn)
2422 		return -ENODEV;
2423 
2424 	if (!of_match_node(brcmnand_of_match, dn))
2425 		return -ENODEV;
2426 
2427 	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
2428 	if (!ctrl)
2429 		return -ENOMEM;
2430 
2431 	dev_set_drvdata(dev, ctrl);
2432 	ctrl->dev = dev;
2433 
2434 	init_completion(&ctrl->done);
2435 	init_completion(&ctrl->dma_done);
2436 	nand_hw_control_init(&ctrl->controller);
2437 	INIT_LIST_HEAD(&ctrl->host_list);
2438 
2439 	/* NAND register range */
2440 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
2441 	ctrl->nand_base = devm_ioremap_resource(dev, res);
2442 	if (IS_ERR(ctrl->nand_base))
2443 		return PTR_ERR(ctrl->nand_base);
2444 
2445 	/* Enable clock before using NAND registers */
2446 	ctrl->clk = devm_clk_get(dev, "nand");
2447 	if (!IS_ERR(ctrl->clk)) {
2448 		ret = clk_prepare_enable(ctrl->clk);
2449 		if (ret)
2450 			return ret;
2451 	} else {
2452 		ret = PTR_ERR(ctrl->clk);
2453 		if (ret == -EPROBE_DEFER)
2454 			return ret;
2455 
2456 		ctrl->clk = NULL;
2457 	}
2458 
2459 	/* Initialize NAND revision */
2460 	ret = brcmnand_revision_init(ctrl);
2461 	if (ret)
2462 		goto err;
2463 
2464 	/*
2465 	 * Most chips have this cache at a fixed offset within 'nand' block.
2466 	 * Some must specify this region separately.
2467 	 */
2468 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "nand-cache");
2469 	if (res) {
2470 		ctrl->nand_fc = devm_ioremap_resource(dev, res);
2471 		if (IS_ERR(ctrl->nand_fc)) {
2472 			ret = PTR_ERR(ctrl->nand_fc);
2473 			goto err;
2474 		}
2475 	} else {
2476 		ctrl->nand_fc = ctrl->nand_base +
2477 				ctrl->reg_offsets[BRCMNAND_FC_BASE];
2478 	}
2479 
2480 	/* FLASH_DMA */
2481 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "flash-dma");
2482 	if (res) {
2483 		ctrl->flash_dma_base = devm_ioremap_resource(dev, res);
2484 		if (IS_ERR(ctrl->flash_dma_base)) {
2485 			ret = PTR_ERR(ctrl->flash_dma_base);
2486 			goto err;
2487 		}
2488 
2489 		flash_dma_writel(ctrl, FLASH_DMA_MODE, 1); /* linked-list */
2490 		flash_dma_writel(ctrl, FLASH_DMA_ERROR_STATUS, 0);
2491 
2492 		/* Allocate descriptor(s) */
2493 		ctrl->dma_desc = dmam_alloc_coherent(dev,
2494 						     sizeof(*ctrl->dma_desc),
2495 						     &ctrl->dma_pa, GFP_KERNEL);
2496 		if (!ctrl->dma_desc) {
2497 			ret = -ENOMEM;
2498 			goto err;
2499 		}
2500 
2501 		ctrl->dma_irq = platform_get_irq(pdev, 1);
2502 		if ((int)ctrl->dma_irq < 0) {
2503 			dev_err(dev, "missing FLASH_DMA IRQ\n");
2504 			ret = -ENODEV;
2505 			goto err;
2506 		}
2507 
2508 		ret = devm_request_irq(dev, ctrl->dma_irq,
2509 				brcmnand_dma_irq, 0, DRV_NAME,
2510 				ctrl);
2511 		if (ret < 0) {
2512 			dev_err(dev, "can't allocate IRQ %d: error %d\n",
2513 					ctrl->dma_irq, ret);
2514 			goto err;
2515 		}
2516 
2517 		dev_info(dev, "enabling FLASH_DMA\n");
2518 	}
2519 
2520 	/* Disable automatic device ID config, direct addressing */
2521 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_SELECT,
2522 			 CS_SELECT_AUTO_DEVICE_ID_CFG | 0xff, 0, 0);
2523 	/* Disable XOR addressing */
2524 	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_XOR, 0xff, 0, 0);
2525 
2526 	if (ctrl->features & BRCMNAND_HAS_WP) {
2527 		/* Permanently disable write protection */
2528 		if (wp_on == 2)
2529 			brcmnand_set_wp(ctrl, false);
2530 	} else {
2531 		wp_on = 0;
2532 	}
2533 
2534 	/* IRQ */
2535 	ctrl->irq = platform_get_irq(pdev, 0);
2536 	if ((int)ctrl->irq < 0) {
2537 		dev_err(dev, "no IRQ defined\n");
2538 		ret = -ENODEV;
2539 		goto err;
2540 	}
2541 
2542 	/*
2543 	 * Some SoCs integrate this controller (e.g., its interrupt bits) in
2544 	 * interesting ways
2545 	 */
2546 	if (soc) {
2547 		ctrl->soc = soc;
2548 
2549 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_irq, 0,
2550 				       DRV_NAME, ctrl);
2551 
2552 		/* Enable interrupt */
2553 		ctrl->soc->ctlrdy_ack(ctrl->soc);
2554 		ctrl->soc->ctlrdy_set_enabled(ctrl->soc, true);
2555 	} else {
2556 		/* Use standard interrupt infrastructure */
2557 		ret = devm_request_irq(dev, ctrl->irq, brcmnand_ctlrdy_irq, 0,
2558 				       DRV_NAME, ctrl);
2559 	}
2560 	if (ret < 0) {
2561 		dev_err(dev, "can't allocate IRQ %d: error %d\n",
2562 			ctrl->irq, ret);
2563 		goto err;
2564 	}
2565 
2566 	for_each_available_child_of_node(dn, child) {
2567 		if (of_device_is_compatible(child, "brcm,nandcs")) {
2568 			struct brcmnand_host *host;
2569 
2570 			host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
2571 			if (!host) {
2572 				of_node_put(child);
2573 				ret = -ENOMEM;
2574 				goto err;
2575 			}
2576 			host->pdev = pdev;
2577 			host->ctrl = ctrl;
2578 
2579 			ret = brcmnand_init_cs(host, child);
2580 			if (ret) {
2581 				devm_kfree(dev, host);
2582 				continue; /* Try all chip-selects */
2583 			}
2584 
2585 			list_add_tail(&host->node, &ctrl->host_list);
2586 		}
2587 	}
2588 
2589 	/* No chip-selects could initialize properly */
2590 	if (list_empty(&ctrl->host_list)) {
2591 		ret = -ENODEV;
2592 		goto err;
2593 	}
2594 
2595 	return 0;
2596 
2597 err:
2598 	clk_disable_unprepare(ctrl->clk);
2599 	return ret;
2600 
2601 }
2602 EXPORT_SYMBOL_GPL(brcmnand_probe);
2603 
2604 int brcmnand_remove(struct platform_device *pdev)
2605 {
2606 	struct brcmnand_controller *ctrl = dev_get_drvdata(&pdev->dev);
2607 	struct brcmnand_host *host;
2608 
2609 	list_for_each_entry(host, &ctrl->host_list, node)
2610 		nand_release(nand_to_mtd(&host->chip));
2611 
2612 	clk_disable_unprepare(ctrl->clk);
2613 
2614 	dev_set_drvdata(&pdev->dev, NULL);
2615 
2616 	return 0;
2617 }
2618 EXPORT_SYMBOL_GPL(brcmnand_remove);
2619 
2620 MODULE_LICENSE("GPL v2");
2621 MODULE_AUTHOR("Kevin Cernekee");
2622 MODULE_AUTHOR("Brian Norris");
2623 MODULE_DESCRIPTION("NAND driver for Broadcom chips");
2624 MODULE_ALIAS("platform:brcmnand");
2625